Governed AI for investment operations

What "governed AI" actually means

Governed AI in investment operations means that every AI capability is declared, versioned, evaluated, policy-controlled and auditable before and while it touches production workflows. Concretely: you can enumerate every agent in use, state which version is live and what it may access, prove its quality against a versioned test set, require human approval on sensitive actions, and reconstruct any past run for an auditor.

The definition is deliberately operational. Most financial institutions already have AI policies — principles about fairness, transparency and accountability. The governance that unlocks production is the enforcement layer underneath: infrastructure that makes the policy's answers automatic. A principle that "humans must oversee material AI actions" is satisfied not by a paragraph but by an approval gate that pauses the run and records who decided what, and why.

Why ungoverned pilots stall: the 78/27 problem

SimCorp's research on scaling AI agents in investment management reports that 78% of investment managers are piloting agentic AI while only 27% see significant business impact. Mercer's global survey is harsher on outcomes: 91% of asset managers use or plan to use AI, but only 8% report measurable return improvements. Budgets keep rising regardless — 88% of senior executives plan increases per PwC's May 2025 survey — which makes the conversion failure expensive.

Where exactly do pilots die? Rarely in the demo. They die in the reviews that stand between a demo and a production workflow — model risk, information security, compliance, internal audit — when the team cannot answer structural questions: Which exact version of this agent ran? What data did it see on run #4,217? Who approved the action it took? How do you know last week's prompt change did not degrade accuracy? What does it cost per task, per team? A pilot built as a script wrapping an LLM has no good answers. The review concludes, reasonably, that the institution cannot certify what it cannot reconstruct.

The governance stack, layer by layer

Institutions that cross the production gate converge on five enforcement layers:

• —Declared, versioned agents — a registry (ideally Git-backed, with peer review on every change) defining each agent's prompt, model, tools, schemas and permissions. The registry is exclusive: nothing undeclared can run, which structurally eliminates shadow AI.
• —Evaluation gates — each agent ships a versioned test dataset and a baseline score; CI re-runs evaluations on every change and flags regressions, so releases are gated on evidence, not confidence.
• —Tool policies and human-in-the-loop — per-tool allow/ask/deny rules; irreversible actions default to requiring explicit human approval, recorded as a first-class audit event with who, when and why.
• —Reconstructible audit — per-step tracing of every model and tool call, an append-only audit log with retention matched to the firm's regulatory obligations (multi-year in this vertical), and the registry version recorded per run so an auditor can replay history exactly.
• —Cost and capacity governance — hard per-run budgets (duration, tool calls, tokens), per-team quotas, and dashboards attributing cost per run, agent and tenant.

The regulatory backdrop

Supervisors did not wait for agents. Investment operations already carries audit and accountability obligations — recordkeeping, four-eyes controls, demonstrable process integrity — and an AI action inside a NAV or reconciliation process inherits the expectations of that process. In Europe, the EU AI Act adds explicit documentation, transparency and human-oversight requirements that apply to financial institutions deploying AI systems, and existing model-risk and outsourcing frameworks already require firms to understand and control third-party AI behavior.

The practical reading: regulation rewards architectures where evidence is a by-product of operation. If audit trails, approval records and version history are generated structurally, regulatory documentation becomes an export, not a project. If they must be reconstructed forensically after the fact, every examination is expensive and every incident is unexplainable. This asymmetry is strongest in Europe, where supervisory scrutiny of AI in financial services is most explicit.

The auditor's checklist

A useful exercise before any agentic deployment — vendor-provided or in-house — is to confirm the system can answer an auditor's questions without engineering archaeology:

• —Enumerate every AI agent in production, with owner, version and change history.
• —For any past run: show the exact agent version, input, ordered tool calls with their data, output, cost and duration.
• —Show the evaluation results that justified the currently deployed version, and the baseline it must not regress below.
• —List every action requiring human approval, and produce the decision record for a given approval.
• —Demonstrate that credentials and prompt content never appear in logs or telemetry.
• —Show per-tenant isolation: prove one client's agents cannot read another's data.
• —State data residency for inference, traces and audit storage — and who can change it.

Governance as an accelerator, not a brake

The instinctive framing — governance slows AI down — inverts the observed reality. In regulated institutions, the governed route is the only route that terminates in production; everything else terminates in review. Teams with a governance substrate ship their second and tenth agents faster than their first, because security review, audit posture, evaluation harness and cost controls are inherited rather than rebuilt.

There is also a procurement signal in governance maturity. Vendors competing on agent counts and unaudited ROI percentages are marketing to the pilot phase; vendors competing on registries, evaluation gates and audit reconstruction are selling to the production phase. The questions in the checklist above separate the two quickly.