The use of AI is accelerating across the financial sector, and the regulatory framework is taking shape. Published in July 2026, the Digital Omnibus Regulation on AI confirmed the overall direction of the 2024 AI Act while postponing certain deadlines. Compliance efforts must therefore continue.
However, a new challenge is emerging: how can banks ensure the quality, risk control and security of AI systems in the face of the rapid multiplication of use cases?
This is where ISO standards come in. Published in December 2023, ISO/IEC 42001 is the first international standard dedicated to the management of artificial intelligence. It offers a sustainable governance framework covering policies, responsibilities, risk management, controls and continuous improvement.
But what value can it bring to the banking sector? Perhaps, the question should be framed differently: could an additional standard help simplify compliance with other frameworks?
For banks, the value goes beyond the prospect of certification. It lies first and foremost in streamlining AI governance and its compliance processes.
The AI Act sets obligations according to the nature of the systems, their level of risk and the institution's role. Banks must identify relevant use cases, classify them and apply the corresponding requirements: documentation, data, traceability, human oversight and robustness.
ISO 42001 operates at a more organisational level: how should an institution be organised to meet these requirements over time? Without replacing the AI Act, it provides a management framework that can facilitate its implementation.
Industrialise rather than multiply compliance projects
The main challenge for large institutions is the growing number of AI systems. With the development of machine learning, generative AI and agentic AI, treating each project in isolation will become increasingly difficult to sustain. Banks will have to ensure the ongoing compliance of several hundred systems running in parallel.
ISO 42001 can help banks move from a project-based approach to industrialised AI governance.
The standard encourages a structured overview of the systems developed or used. This inventory can serve as the basis for classifying them under the AI Act, without creating two parallel arrangements. A common risk classification then makes it possible to adjust validation and control levels accordingly.
When a bank is itself classified as a provider under the AI Act, ISO 42001 can also help standardise the necessary processes: pre-deployment validation, system monitoring, change control and incident handling.
Finally, responsibilities among the Business units, Data/AI, IT, Risk, Compliance, Legal and Audit functions must be defined globally rather than project by project. The standard can therefore rationalise roles, procedures and controls, while also facilitating regulatory oversight.
AI suppliers, a point of convergence for risks
This convergence between standards and regulation also applies to the oversight of external suppliers.
An increasing share of the AI systems used by banks relies on SaaS solutions, cloud platforms, APIs or components developed by third parties. Oversight is becoming essential: understanding the solutions, documenting them, tracking model evolution, allocating responsibilities, monitoring and defining exit conditions.
Two recent regulations converge on this issue: the AI Act organises responsibilities across the AI value chain, while DORA governs the risks related to ICT service providers, notably technological dependencies, subcontracting, continuity and concentration.
A single supplier may therefore fall under several internal control frameworks, that are not necessarily coordinated.
ISO 42001 can help align them by strengthening existing AI supplier management processes: providing clearer responsibilities, harmonised requirements and consistent risk monitoring.
Certification as an additional source of value
Beyond internal organisation, ISO 42001 raises the possibility of independent certification. In this scenario, a certification body audits the AI management system. It verifies not only that the policies, responsibilities and controls required by the standard are in place, but also that they work in practice, on the basis of documented evidence.
Certification imposes discipline: explicit responsibilities, formalised controls, demonstrated effectiveness and continuous improvement.
Its value lies in this external assurance, and also in helping banks organise regulatory obligations more efficiently. ISO 42001 provides an auditable governance framework into which the applicable AI Act requirements can be integrated: risk management, documentation, human oversight, system monitoring, change control and incident handling.
Building on existing frameworks
The key to success, however, will be avoiding turning ISO 42001 into yet another compliance programme. Banks already have many of the building blocks in place: model governance, data governance, internal control, cybersecurity, project validation and third-party management.
The objective is therefore to analyse the gaps between regulatory obligations and ISO 42001 requirements, to identify areas of convergence and complementary needs. Existing processes and controls can then adapted to address these needs, without creating a parallel framework. This approach should be led by the function responsible for AI governance, working closely with Risk and Compliance.
With this approach, investment in ISO 42001 can be assessed in terms of marginal cost: what additional resources are really needed to make existing arrangements consistent, auditable and, potentially, certifiable?
An opportunity worth exploring now
ISO 42001 remains relatively little known in the financial sector. Yet its potential benefits are tangible: industrialising AI Act compliance, rationalising governance arrangements and providing external assurance on how they work.
In a sector where trust remains an essential asset, being among the first institutions in France to achieve ISO 42001 certification could also be a differentiating factor.
Like the role played by ISO 27001 in cybersecurity, this certification could become a strong signal of AI maturity and control, addressed to clients, partners and regulators.
Sopra Steria supports financial institutions in this twofold approach: assessing their AI practices against the AI Act and building an auditable, sustainable governance framework in line with ISO 42001. We believe these two workstreams should be designed together from the outset, to pool efforts, avoid redundant arrangements and make the most of investments already made.
