What does Taiwan FSC AI Guidelines say about AI in banking?

What are the key points of Taiwan FSC AI Guidelines?

• Structure: General Provisions plus six chapters, one per core principle: governance and accountability, fairness and human-centred values, privacy and customer interests, system robustness and security, transparency and explainability, sustainable development.
• Life cycle (General Provisions II): four stages, namely system planning and design, data collection and input, model building and validation, and system deployment and monitoring. An institution that buys or commissions a system is advised to identify how far it can monitor and control risk at each stage and to define the division of responsibilities with vendors by contract.
• Risk assessment (General Provisions III): six factors, namely whether the system serves customers directly or has a significant impact on operations, extent of use of personal data, extent of AI autonomy, complexity, extent and reach of impact on stakeholders, and integrity of relief options. Credit scoring and robo-advice ('robotic financial management systems') are given as examples that usually carry higher risk, intelligent customer service as one that may carry lower risk; the institution decides the risk level.
• Higher-risk systems (General Provisions IV): beyond the chapter measures, the institution must evaluate whether to adopt more comprehensive records, more frequent and wider monitoring and control, a more stringent review and approval process at an elevated decision-making level, and independent verification by a third-party audit or evaluation unit if necessary.
• Third-party providers (General Provisions V): review the provider's knowledge, expertise and experience and the concentration risk; sign written contracts on scope, responsibilities and recourse; where customer data is transmitted, agree terms that 'clearly require encrypted data transmission, secure storage, and data disposal upon termination of services'; set up a data or system migration mechanism for termination; and require operation records.
• Governance (Chapter 1): a senior executive or committee able to oversee inter-departmental business may be designated for overall supervision of AI; AI risk management is integrated into the existing risk management and internal control framework, including model risk management, information security, data protection and treating customers fairly.
• Human oversight and generative AI (Chapter 2): defines human-in-command, human-in-the-loop and human-over-the-loop supervision. Where an institution uses generative AI developed by a third party and cannot control the training process or ensure fair results, risks in its output 'must be objectively and professionally controlled by its personnel'.
• Customers (Chapters 2, 3 and 5): institutions are advised to inform customers, respect their right to choose whether to use AI services and remind them of alternatives; before AI interacts directly with a consumer, 'it is advisable to proactively inform the consumer that the interaction or service is provided with automated response from an AI system'; remedies are encouraged but may be withheld for money-laundering prevention or fraud-detection systems where unsuitable.

What did Taiwan FSC AI Guidelines change for banks?

The Guidelines gave Taiwan's financial sector a detailed, life-cycle AI reference from the regulator. The FSC consulted on the draft through the government's public participation platform, fintech meetings and two consultation meetings, and adjusted it at industry's request: institutions may choose more cost-effective ways to mitigate risk, the risk examples do not fix risk levels, review by an independent third party is optional, and explainability is limited to systems an institution develops itself or commissions. They remain guidance. Article 16 of the AI Basic Act of January 2026 now directs sectoral regulators such as the FSC to set risk-based management rules where needed.