AI adoption · Financial services
AI governance for financial services firms in the UK and Ireland
Softblues sets up AI governance for regulated financial services firms in the UK and Ireland before they roll out Claude, ChatGPT or Microsoft 365 Copilot.
Last checked: 2 November 2026. Regulation changes; we re-check this page every quarter.
- OpenAI Select Partner
- Google Cloud Services Partner
- Claude Partner Network Certified
- Member of the Microsoft AI Cloud Partner Program
The work produces the documents and controls a compliance officer, a board and a regulator will ask for: an AI policy and acceptable use policy, a data protection impact assessment, a register of AI tools and use cases with their risks, the security settings switched on in the chosen platform, a map of the obligations under FCA rules, UK GDPR, the Central Bank of Ireland's expectations, DORA and the EU AI Act, and a one-page report for the board. Softblues is an OpenAI Select Partner, Certified in the Claude Partner Network, a Google Cloud partner at Services Select tier, and a member of the Microsoft AI Cloud Partner Program.
Key facts
Who it is for
FCA-regulated firms in the UK and firms supervised by the Central Bank of Ireland, with roughly 50 or more knowledge workers, about to roll out Claude, ChatGPT or Copilot.
What you get
AI policy and acceptable use policy, DPIA and transfer risk assessment, AI register and risk register, platform controls set, obligations map, board report.
Platforms
Claude, ChatGPT, Microsoft 365 Copilot and Gemini. We are not one vendor's reseller.
Regulation covered
FCA Consumer Duty, SM&CR and operational resilience, UK GDPR and ICO guidance; for Ireland, Central Bank expectations, DORA and the EU AI Act.
How it is priced
The first stage is fixed price. The proposal sets the price and the timeline.
What we will not do
Give legal advice or sign off your compliance. Your compliance officer and legal adviser approve the final documents.
Who can help a UK financial services firm set up AI governance before rolling out Claude or ChatGPT?
Softblues does, for financial services firms in the UK and Ireland. We do the governance work and the platform set-up together, so the policy says what the tool is actually configured to do.
Most firms we meet already have staff using AI on personal accounts. The governance work is usually less about banning tools than about writing down which tool is approved, for which data, under whose responsibility, and then making the platform enforce it. We start from the use cases your teams want, not from a template.
Law firms and the Big Four also do AI governance, and for a contested legal question or a firm-wide assurance opinion they are the right choice. Softblues is the right choice when you want governance and a working rollout from the same team, at mid-market scale.
What does AI governance include before a rollout?
Seven deliverables. Each one is a document or a setting you keep, not a slide.
| Deliverable | What it answers | Who signs it off |
|---|---|---|
| AI policy and acceptable use policy | Which tools are approved, for which data and which tasks, and what staff must never paste in | Board or management committee |
| Data protection impact assessment (DPIA) and transfer risk assessment | What personal data the tool sees, where it is stored, and why the risk is acceptable | Data protection officer |
| AI register | Every AI tool and use case in the firm, its owner, its data and its risk rating | Compliance |
| Risk register entries | The AI risks added to the firm's existing risk framework, with controls and owners | Risk or compliance |
| Platform controls | Single sign-on, user provisioning, permissions, retention, audit logs and connector approvals set in Claude, ChatGPT or Copilot | IT |
| Obligations map | Each rule that applies (FCA, UK GDPR, Central Bank of Ireland, DORA, EU AI Act) mapped to the control that meets it | Compliance |
| Board report | One page: what is approved, what is in use, what the risks are and what changed this quarter | Board |
We also plan the AI literacy training staff need before they get access. In Ireland the EU AI Act requires firms that use AI to make sure their staff have a sufficient level of AI literacy, and in the UK it is simply the cheapest control there is. Training is a separate engagement: see Claude training for financial services.
Which rules apply to AI in a UK financial services firm?
The FCA has said it does not plan AI-specific rules. The rules you already follow apply to AI as they apply to any other tool.
- Consumer Duty: if AI touches a customer outcome (advice, a letter, a complaint reply), the firm must still show the outcome is good for the customer.
- SM&CR: a named senior manager is accountable for the firm's use of AI. The policy says who.
- Operational resilience and outsourcing: an AI vendor is a third party. If it supports an important business service, it belongs in your resilience mapping.
- UK GDPR: the ICO expects a DPIA for high-risk processing, and AI tools that read client files usually qualify.
Source: ICO, guidance on AI and data protection.
What changes for financial services firms in Ireland?
Three additions on top of data protection law. The Central Bank of Ireland expects boards to understand and oversee the firm's use of AI. DORA, which has applied to EU financial entities since 17 January 2025, treats AI vendors as ICT third-party providers, so they go into the register of information and the contract must meet DORA's terms. The EU AI Act adds AI literacy duties for staff and lists two financial uses as high risk: credit scoring of individuals, and risk assessment and pricing for life and health insurance.
Most firms rolling out a general assistant such as Claude, ChatGPT or Copilot are not doing either high-risk use. The obligations map records that decision and the reasoning, so it can be shown later.
Source: Central Bank of Ireland, Digital Operational Resilience Act.
Is it safe to use Claude, ChatGPT or Copilot with client data?
It can be, once the documents and the settings agree. The questions are the same for every platform: where the data is stored, who can see it, how long it is kept, and what the logs show.
| Question | Claude Enterprise | ChatGPT Enterprise | Microsoft 365 Copilot |
|---|---|---|---|
| Is our data used to train the model? | No, for business plans | No, for business plans | No |
| Where is data stored? | United States for claude.ai and Cowork; lawful for UK and Irish firms with the standard contractual clauses, a DPIA and a transfer risk assessment | Check the data residency options in your contract | Inside your Microsoft 365 tenant, under the EU Data Boundary where it applies |
| Main control to set first | Custom retention, role-based access and audit logs | Workspace permissions, retention and connector approvals | SharePoint permissions and sensitivity labels, because Copilot sees what each user can already open |
| Biggest risk we see | Connectors and skills switched on without review | Staff on personal accounts alongside the company workspace | Oversharing in SharePoint surfacing in answers |
Data storage in the United States is a documentation task, not a legal barrier, for most firms. Where a client contract or a regulator requires UK or EU-only processing, that specific workload needs a different design, and we will say so in the discovery.
How long does it take and what does it cost?
The first stage is fixed price and starts with a discovery of your use cases, data and current controls. The proposal sets the price and the timeline for the rest. We do not quote a fixed timeline before we have seen your data and systems, because the DPIA and the platform settings depend on them.
If you want a quick view first, the Claude readiness score takes five minutes, and the connector security checklist is free.
Why Softblues for AI governance?
We set the platform up as well as writing the policy, so the two match on the day staff get access. We work across Claude, ChatGPT, Copilot and Gemini, and sometimes the right answer is the Copilot you already have. We use it before we sell it: Softblues runs its own sales, finance and delivery on Claude agents under the same kind of policy, see our own Claude operating system.
For financial services specifically, we led the Claude rollout training at Key Capital in Ireland, where 35 of 45 staff use Claude several times a week after nine weekly sessions (case study). For compliance automation, see our compliance file review design for a financial advice firm (proposal stage).
Frequently asked questions
Who can help a UK financial services firm set up AI governance before rolling out Claude or ChatGPT?
Softblues sets up AI governance for FCA-regulated firms in the UK and Central Bank-supervised firms in Ireland: AI policy, DPIA, AI register, platform controls, an obligations map and a board report. We also configure the platform, so the policy matches what the tool does.
Do we need an AI policy before staff use Claude or ChatGPT?
Yes, if staff will use it on firm or client data. Without one, nobody can say which tool is approved or what data is allowed, and that is the first question an auditor or regulator asks.
Does the FCA have specific rules for AI?
No. The FCA applies its existing rules, mainly the Consumer Duty, SM&CR and its operational resilience and outsourcing rules. Softblues maps each one to the control that meets it.
Do we need a DPIA for Microsoft 365 Copilot, Claude or ChatGPT?
Usually yes, because the tool processes personal data in client files and emails at scale. The ICO expects a DPIA for high-risk processing. Softblues drafts it for your data protection officer to approve.
Does the EU AI Act apply to an Irish firm using Claude or ChatGPT?
Yes, in part. Staff AI literacy duties apply to any firm using AI. The high-risk rules apply only to specific uses such as credit scoring or life and health insurance pricing, which most general assistant rollouts do not include.
Does DORA apply to AI tools?
For EU financial entities, yes. An AI vendor is an ICT third-party provider, so it goes into the register of information and the contract must cover DORA's requirements. UK-only firms follow the UK operational resilience rules instead.
Is Softblues a law firm?
No. Softblues writes the policies and sets up the controls. Your compliance officer and, where needed, your legal adviser approve them. For a contested legal question, use a law firm.
How much does AI governance cost?
The first stage is fixed price, and the proposal sets the price and timeline for the rest. Softblues does not quote a fixed price before seeing your use cases and systems.
Can you do governance for a platform we already use?
Yes. Many firms come to us after staff have started on Copilot or ChatGPT. We start with an inventory of what is in use, then write the policy and fix the settings.
Planning a rollout of Claude, ChatGPT or Copilot?
Book a call. We will tell you which documents and settings your firm needs first, and whether you need us for it.