AI governance for financial services
One governed workspace to help financial services firms use AI confidently, apply company policies and maintain human accountability.
Dutira brings AI access, company policies, human oversight and management reporting together in one governed workspace.
Policy checks · AI Acceptable Use v14
Permitted · 5 of 5Three changes take effect from 1 November [1]:
Source [1] Complaints Handling Procedure v3.2 · section 4
Decision recorded to the audit trail · DEC-20481 Included in monitoring and compliance reports
Policy controls active
Illustrative — not a live customer environment
Compliance overview Illustrative
AI usage activity
3,690 requests · 30 days
Why governance
The question for a regulated firm is not which model its people use. It is how they benefit from AI without losing control over confidentiality, accuracy, decisions, accountability and regulatory risk.
One AI workspace for your people. One governance platform for your business.
One governed workspace connecting AI access, company policies, human oversight and management reporting. Launched in phases; Phase 1 is below.
Enable your people to use approved AI tools within company-defined safeguards.
ExploreTurn written AI requirements into practical safeguards, workflows and staff acknowledgements.
ExploreUnderstand how AI is used and identify potential policy risks.
ExploreGive decision-makers the visibility and evidence needed for responsible AI adoption.
ExploreBuilt for the Next Generation of AI Governance
As firms take AI beyond employee chat, the platform grows with them. These capabilities are planned, not yet available.
Phase 1Available now
Initial MVP
Governed workspace, policy upload and management, attestation, awareness training, workspace monitoring, human review, management oversight, free checker.
Phase 2Planned
Advanced governance
Expanded continuous monitoring, external AI integrations, advanced policy workflows, deeper incident management, governance analytics.
Phase 3Planned
AI lifecycle governance
AI inventory, risk assessments, testing evidence, pre-deployment approvals, periodic reviews, retirement.
Phase 4Planned
AI agent governance
Agent identities, delegated permissions, tool-level controls, action monitoring, approval checkpoints, execution audit trails.
From AI policy to everyday practice
Dutira helps turn company AI policies into employee guidance, practical safeguards, approval workflows and management evidence. Not every written policy can become a technical control; where it cannot, it becomes guidance, training and attestation — and the record shows which.
PDF, Word or text. The obligations it places on staff are extracted.
OpenEach requirement with an indicative risk and the controls that could meet it — suggestions, not settings.
OpenAn administrator decides what applies and configures controls in the workspace.
OpenAssigned awareness modules, knowledge checks and version-specific attestations.
OpenPolicy warnings, exceptions and risk events inside the workspace.
OpenAdoption, governance, risk and accountability on one dashboard, with downloadable evidence.
OpenFinancial services
For wealth and asset managers, investment firms, financial advisers, banks and building societies, insurers and fintech companies.
Controlled AI use in investment research, reporting, document analysis and internal operations.
Governance considerations: Client and portfolio data, the accuracy of figures, and anything that becomes client commentary or a financial promotion.
AI in administrative workflows — meeting notes, file reviews and letters — while protecting client information.
Governance considerations: Personal recommendations remain the adviser’s regulated responsibility. AI can help draft, but a qualified person reviews before anything reaches a client.
AI access policies, sensitive-data controls and monitoring across teams and approved workflows.
Governance considerations: Account, card and payment data; many teams and channels; complaint handling rules.
Policy management, employee training, incident reviews, management information and documentation.
Governance considerations: Showing that controls exist and work, that people understood the rules, and who decided what.
Inside the platform
One identity model, one policy engine and one audit trail connect the four areas below — so evidence is produced by everyday use, not assembled afterwards.
01 AI Workspace
A familiar chat interface for everyday work. Every request is checked against your policies before it reaches a model, and every response before it is shown.
Model choices (currently OpenAI, Anthropic and Google models through their APIs), integrations and deployment options are subject to supported configurations and your agreements with each provider.
Three changes take effect from 1 November [1]:
Source [1] Complaints Handling Procedure v3.2 · section 4
02 Policy & Control
Publish your policies, set the rules behind them, and decide what happens: allow, warn, mask, require approval, escalate or block.
Test bench · draft v15
“Draft a letter to the client on card 4417 1234 5678 9113…”
Blocked · card numberSame result on v14 and draft v15
03 Monitoring & Risk
Usage, exceptions and trends for the AI activity that runs through the platform, with alerts, investigation cases and incident management.
Monitoring covers AI activity that passes through the platform and the tools you integrate with it. Coverage depends on those integrations, permissions and your deployment configuration — the platform does not automatically see AI use in other third-party tools. Attestation exceptions and incident reports help surface use elsewhere.
Active employee accounts
412
AI interactions monitored
3,690
Policy exceptions
38
Interactions and exceptions by week
Interactions Exceptions04 Training & Audit
Role-based courses, attestations that let people declare exceptions, and an evidence centre for management reports and audit-ready exports.
Employee view
Quarterly AI attestation
I have read AI Acceptable Use Policy v2.0
I have used only approved AI tools for firm work
“Used a browser translator once in August — reported as INC-0001.”
I understand how to report an AI incident
Submitted 22 Oct 2026, 10:41 · policy versions recorded
How governed AI works
The policy your people attest to is the policy applied to every AI request — and every request adds to the evidence.
Step 1
Ask
An employee asks a question or adds a document in the AI Workspace.
Step 2
Check
Five checks run first: model access, company policy, sensitive information, FCA-linked controls and human approval.
Step 3
Decide
The request is allowed, masked, held for approval or blocked — and the employee sees why.
AllowMaskApprovalBlock
Step 4
Respond
Approved requests go to the selected model. The response is checked before it is shown.
Step 5
Record
The decision goes to the audit trail and feeds monitoring, alerts and management reports.
Policies and training set the rules
Attestations confirm people understand them
Reports show management how it is working
Continuous, not a once-a-year compliance exercise.
FCA AI guidance · 19 October 2026
The FCA’s AI in financial services: good practice and areas for improvement shares what it has seen across supervision, industry engagement and its AI Lab. Existing rules still apply; the examples themselves, the FCA says, “do not create new requirements”. There is no standalone FCA AI rulebook.
Dutira helps firms turn those examples into working, evidenced arrangements — proportionate to their size and risk.
How Dutira helps
How Dutira helps
How Dutira helps
Check your arrangements against it. The free checker covers ten governance areas from the publication and the rules behind it, and labels every source as a rule, guidance or good practice.
Regulation
Adopting AI does not change a firm’s obligations. The FCA has said it relies on its existing frameworks rather than AI-specific rules — so the question is how you meet them when your people use AI.
Dutira is designed to help firms address those expectations and evidence their controls.
Apply to every authorised firm, including how it uses AI — notably skill, care and diligence, management and control, and openness with regulators.
Dutira: Policies, controls and records that show how AI use is organised and supervised.
Named senior managers are accountable for their areas, including the AI used in them. The firm decides how AI responsibilities are allocated.
Dutira: Recorded ownership, management information and senior management reviews with recorded challenge.
Individual conduct standards for most staff of SM&CR firms — including acting with due skill, care and diligence when relying on AI output.
Dutira: Acceptable-use policies, role-based training and attestations that record exceptions.
Where relevant, firms map and test the services their important business services depend on — increasingly including AI providers.
Dutira: Third-party AI register, provider dependencies by use case, and more than one model provider under the same policies.
Personal and client data stays subject to data protection law and confidentiality duties when it is used with AI. The ICO regulates data protection.
Dutira: Sensitive-data detection and masking, encryption at rest, retention controls and logged access to content.
The FCA’s October 2026 publication shares illustrative examples — sign-off before deployment, an inventory of AI use, human oversight, monitoring. It says they create no new requirements.
Dutira: Each of these themes has a matching workflow in the platform.
Not sure where you stand?
Take the free AI governance readiness assessment: eight questions, results straight away.
Which provisions apply depends on each firm’s permissions, business and status. The FCA does not require firms to buy AI governance software, and Dutira is not approved by the FCA: it supports a firm’s own arrangements, and responsibility stays with the firm.
Security and data governance
Straight answers to the questions your security, data protection and risk teams will ask.
In the product today
Planned, or confirmed per engagement
We do not currently hold ISO 27001 or SOC 2 certification, and an independent penetration test has not yet been completed. We will share our security documentation and the current position as part of due diligence.
Senior management
Financial institutions need to understand how AI is being used, who is accountable and whether the relevant controls are operating effectively. Illustrative data for a fictional firm — in the product, every figure comes from your own records.
AI adoption by business function, approved models, policy exceptions, material risk alerts, training and attestations, incident escalation and management reporting.
AI requests
3,690
through the workspace
Policy exceptions
38
blocked, masked or held
Material risk alerts
2
above threshold · open
Training completion
91%
mandatory courses
Attestations submitted
82%
Q4 cycle · due 1 Nov
Pending approvals
5
1 past target time
AI adoption by business function
Requests · exceptionsPolicy exceptions
Pseudonymised · no prompt textTraining and attestations
Approved models
Data ceiling · sharePending approvals
Incidents and escalation
3 open · 1 escalatedManagement reporting
Draft for reviewQ4 2026 report to the Risk & Compliance Committee
Want to click around? Open the interactive sandbox — a private demo of a fictional firm, with synthetic data.
Why Dutira
Each buyer gets what they need from the same platform — without slowing down the people using AI.
One place to see and evidence how AI is used.
One control point for every model and team.
AI transformation with the oversight the board expects.
Free AI governance readiness assessment
Eight questions, about three minutes. See possible gaps straight away — no sign-up needed.
A self-assessment to highlight possible gaps in your AI governance arrangements. It is not an FCA compliance certification, an audit or legal advice.
Want the full picture? Run the FCA AI Governance CheckerReadiness assessment
0 of 8 answeredResources
Practical articles, a white paper and illustrative case studies for compliance, risk and technology leaders.
White paper
Governing generative AI in UK financial services: a practical framework
Read or download3 illustrative case studies
How a wealth manager, an insurer and a payments firm could approach AI governance.
See the scenariosInteractive sandbox
Sign in as any of 13 roles at a fictional wealth manager and try the platform.
Open the sandboxFree FCA AI Governance Checker
Identify potential gaps in your AI governance framework against relevant FCA regulatory expectations.
Check Your AI GovernanceFAQ
Straight answers about what Dutira does — and what it does not.
No. The FCA has said it does not plan to introduce AI-specific rules and relies on its existing frameworks — such as the Principles, SYSC systems and controls, SM&CR and, where applicable, the Consumer Duty. Firms decide how to meet those obligations. A platform like Dutira can help organise and evidence your controls; it is not required and it does not replace your own judgement.
Inside the workspace, employees can use approved OpenAI (GPT), Anthropic (Claude) and Google (Gemini) models through the providers’ APIs, under your policies. Whether staff may also use the public consumer apps is your policy decision. Dutira does not block other tools on its own; that needs your network or endpoint controls.
Everything that runs through the platform: each request and the result of the policy checks, approvals, usage and spend, plus training, attestation and incident records. It does not automatically see AI used in other third-party tools. Coverage depends on the tools you route through it, the integrations you enable and your configuration. Attestation exceptions and incident reports help surface AI use elsewhere.
Yes, encrypted, for the retention period you configure, so people can see their history and authorised reviewers can investigate when needed. Blocked requests are kept only in redacted form. Monitoring dashboards show metadata with people pseudonymised by default, and reading anyone’s conversation requires a permission and a recorded reason that is written to the audit log.
Yes. You publish your own policy documents with version control, and configure the rules that apply to AI requests — sensitive-data detection, your own identifiers, approved activities by role, and whether to allow, warn, mask, require approval, escalate or block. Changes can be tested against example prompts before they go live, and every change is versioned.
You open an attestation cycle — monthly, quarterly, annual or after a policy change — tied to specific policy versions. Each person confirms each statement or declares an exception with an explanation; they are never forced to certify. Submissions are timestamped with the policy versions; exceptions create follow-up actions, and overdue attestations can be escalated to line managers.
No. It is a short self-assessment based on your own answers, to highlight areas you may want to look at. It is not an audit, a certification or legal advice. Your answers stay in your browser unless you ask for a follow-up review.
Single sign-on with OpenID Connect is built in and is validated with your identity provider during set-up. Evidence exports are available as JSON and CSV. Integrations with HR, SIEM, DLP or GRC systems are scoped per engagement — tell us what you use and we will confirm what is supported.
No. It gives your compliance, risk and security teams better visibility, workflows and records. Decisions — approvals, investigations, applicability of rules, sign-off of control mappings — stay with qualified people in your firm.
Book a demo
For compliance officers, risk teams and technology leaders.