Every conversation about AI regulation in banking starts with the statute that has not passed and skips the supervisory guidance that has bound the institution since 2011.
Inventory, validation, monitoring, challenge, documentation
A model whose output is a number has had to clear those gates for more than a decade. The expectations are published, the examination process is routine, and the consequences of failing are immediate.
Nobody has properly answered what validation means for generative output. That is a real and interesting gap, and it is not where most programmes are failing.
Most are failing on inventory
If you cannot produce a list of your models and the named individual accountable for each one, the statute arriving in eighteen months is not your most pressing problem.
Several regimes now assume that list exists and can be produced on request. Very few organisations can produce it inside a week.