How the financial sector embraces AI without having the governance conversation
On 7 April 2026 Investment Officer published an article about AI at Dutch custodian banks. The piece is informative and well founded. It describes how InsingerGilissen, ABN Amro MeesPierson and Van Lanschot Kempen use AI for onboarding, document processing and answering client questions.
What struck me was what was not in it. In five pages with four interviewed directors and concrete uses of AI in a heavily regulated sector, the word ‘governance’ does not appear once. The same goes for ‘AI Act’ and ‘risk classification’, and ‘compliance’ does not appear in relation to the use of AI itself either.
I don't blame the journalist or the interviewees for that. In my view it says more about the state of the sector than the answers that were actually given.
What the custodian banks do tell
The applications described are recognisable and relevant. ABN Amro MeesPierson has sped up onboarding, since a complete file can now be finished within two days, internal checks included. InsingerGilissen uses AI to support routine work more smartly: onboarding, document processing, trading and answering frequently asked questions from asset managers. Van Lanschot Kempen is rolling out Copilot365 bank-wide and is developing an internal generative AI model called Leonardo.
These are not experiments but operational use of AI in the primary process of heavily regulated financial institutions.
Van Lanschot Kempen and the ODD example
The most telling example in the article concerns Van Lanschot Kempen. The bank is working on an AI-driven model for Ongoing Due Diligence (ODD): continuous monitoring that, on the basis of ‘carefully defined triggers’, flags changes in behaviour, transactions and risk indicators as they occur. Periodic reviews would then no longer be needed.
That is an AI system that automatically monitors changes in client behaviour and generates risk signals. In the context of financial services (the Wwft, sanctions rules, client integrity) such an application touches directly on the fundamental rights and financial interests of individuals.
Under the EU AI Act, specifically Annex III, AI systems used in the financial sector for assessing creditworthiness, for risk assessment and for fraud detection qualify as potentially high-risk. A system that automatically monitors client behaviour and generates risk signals fits that profile.
Ronald van Barneveld of Van Lanschot Kempen rightly says in the article that processing the signals will largely remain work for people. Human assessment and the involvement of the employee remain crucial. That is the right instinct, but it is not yet a framework. The question is then how that oversight is organised. Is it documented? Has a risk classification been made? Does the IWMS employee who processes the signals know that he or she is operating within an AI application that may qualify as high-risk? Is there a protocol for the case where the model generates an unjustified risk trigger, or worse, misses a justified one?
The pattern that emerges
The Investment Officer article does not stand alone. It fits a broader pattern that I have seen over the past months in conversations with, and articles about, financial service providers in the Netherlands.
The sector is in a specific phase. AI is actively used and the applications are relevant and valuable, but awareness of the governance implications structurally lags behind actual use. Organisations don't know what they don't know.
It is not unwillingness, it is a matter of speed. The technology moves faster than the organisational capacity to control it, and the regulation (the AI Act, DORA, the joint position of DNB and AFM) moves faster than the sector realises.
DNB, AFM, and the convergence nobody expects
The Netherlands is a special case in the European context. DNB and AFM (the Dutch central bank and the Dutch Authority for the Financial Markets) already actively enforce DORA. In April 2024 they published a joint report on AI in the financial sector. The AI Act implementation act is expected in the fourth quarter of 2026.
For financial institutions this means double regulatory pressure: DORA for digital operational resilience and the AI Act for the responsible use of AI systems. In practice those two frameworks converge. An AI system used for risk assessment has to meet both the operational resilience requirements of DORA and the risk management obligations of the AI Act.
37.4% of the Dutch financial sector was already using AI in 2024, well above the EU average of 13.5%. The sector leads in adoption. The question is whether it also leads in control.
The question that is not asked
Financial institutions talk about AI in fixed terms: ‘faster’, ‘more efficient’, ‘more predictable’, ‘smarter’. Those are productivity stories, and rightly so, because the productivity gain is real.
That story, however, crowds out another one that is at least as important, the story of controllability. How do you make sure the AI systems you deploy do what you think they do? How do you classify them? Who is responsible when they don't do what they should?
I don't hear those questions in the Investment Officer article, nor in most of the boardroom presentations I am familiar with, nor in the strategic plans I have seen. That is not a reproach either. I read it as a collective blind spot that becomes more urgent as regulatory pressure rises and the applications grow more complex.
Three questions for every AI application
The governance that is needed does not start with a compliance framework or an external audit. It starts with three questions that every financial institution should be able to answer for each AI application:
- Who owns this application? That is about the daily operation and not about the paperwork. Who monitors whether the AI system is used for its intended purpose?
- What risk profile does this specific use have? A chatbot that answers frequently asked questions is fundamentally different from a system that monitors client behaviour for risk signals. The technology can be identical, the risk is not.
- What is the protocol when the output is unreliable? What happens when the ODD model misses a risk trigger, or generates an unjustified one? Who notices, how quickly, and what are the steps?
Any institution that cannot answer these questions per application is operating with a governance gap that grows with every new AI application that goes live.
The clock is ticking
August 2026 is the date on which the AI Act takes full effect, in four months’ time. The implementation act follows in the fourth quarter, and DNB and AFM become the enforcement authorities for financial institutions.
The custodian banks described in the Investment Officer article are doing nothing wrong. They deploy AI in a way that creates value for their clients and their organisation. The technology is not the problem. The problem is that there is no structure to make sure that use is responsible, documented and controllable, as a daily way of working and not as a theoretical framework.
As far as I am concerned, whether that structure is needed is not up for discussion. What I don't yet know is whether the sector will build it before the supervisor asks about it.
Jan-Willem Rodenhuis is managing partner of Ductus B.V. and writes on miliarium.nl about the effects of AI adoption in regulated sectors.
Sources
Investment Officer, ‘Met AI versnellen depotbanken in onboarding en communicatie’, Geert Dekker, 7 April 2026
CBS AI-monitor, September 2025 (37.4% financial sector)
DNB/AFM joint AI report, April 2024
EU AI Act, Regulation (EU) 2024/1689
Gartner, June 2025 (>40% of agentic AI projects cancelled)
Deloitte, State of AI 2026 (n=3,235, 1 in 5 with mature agentic governance)
CMS Expert Guide, AI laws and regulations in the Netherlands, February 2026