Blog

Hassabis wants a FINRA for AI. Banks already have FINRA.

DeepMind's CEO just proposed a financial-services-style oversight body for frontier AI. The essay is about model labs, but the analogy he chose tells you where the evidence requirements land next: on the firms that use the models.

July 15, 2026 · 5 min read

On July 14, Demis Hassabis published an essay proposing an independent standards body for frontier AI, explicitly modeled on FINRA. Labs would submit new models for a review period of up to 30 days before release, voluntarily at first, then as a condition of deploying into the US market. Testing would cover cyber and biological risk, deception, and attempts to bypass guardrails, with practices like watermarking and human-readable reasoning alongside.

Read it plainly and it has nothing to do with you. It regulates the companies that build frontier models, not the banks, lenders, insurers, and fintechs that call them. Nothing in the proposal creates a new obligation for a firm that uses AI, and it is an essay, not a law. We are not going to pretend otherwise.

The interesting part is the analogy he picked

Of every regulatory model available, aviation, pharma, nuclear, the most credible research leader in AI reached for a financial-services self-regulatory body. That is a claim about what kind of technology this is: one whose oversight should look like the oversight of money. If you work at a regulated financial firm, the frame being proposed for AI governance is the one your compliance team already lives inside. You know how a FINRA-style body behaves, because one examines you.

Oversight at the top always becomes evidence requests at the bottom

Here is the pattern that has repeated through every financial-oversight regime: the rule is written for the institution at the top, and the work lands on member firms as documentation. FINRA reviews brokers, and brokers keep books and records. SOX targeted issuers, and every public company built an internal-controls evidence function. OSFI writes guidelines, and federally regulated firms produce the artifacts that prove adherence. The standards body Hassabis describes would review models at the lab level. The moment a reviewed-model regime exists, the natural question to any firm deploying those models is the mirror image: which models did you use, for what, and can you show us?

That question is not hypothetical even today. Model-risk and technology-risk guidance, SOC 2 audits, and internal review boards are already asking it. A formal AI oversight regime does not create the question, it removes the option of answering with a shrug.

What the deployer side of that framework looks like

If the lab side of the framework is "prove the model is safe to release," the firm side is "prove what your use of it actually did." Concretely, four capabilities:

• Attribution. For any AI-assisted outcome, name the model, the version, and the decision that routed the request there. Per request, not per quarter.
• Screening. Show that prompts were checked for PII and injection before they left the building, and that the check fails closed rather than open.
• Integrity. Produce records an examiner can verify independently. A log your own admin can edit is a story, not evidence. A hash-chained, signed export that a standalone verifier checks offline is evidence.
• Coverage. Answer the hardest question honestly: what about the calls that never went through the governed path? Ungoverned calls are invisible to any dashboard that only sees its own traffic, so you need a way to go looking for them.

This is the job RemKey exists to do: be the AI layer you can prove to a regulator. Point your existing OpenAI or Anthropic client at one base URL and the first three happen on every call from the first request, the model and routing decision written to a hash-chained, Ed25519-signed ledger, the prompt screened fail-closed before it leaves, and the export verifiable by your auditor offline, with a standalone tool, without trusting us. The fourth is where we are candid about the line between shipped and roadmap: we can scan a codebase today for the AI calls that bypass the governed path, and proving coverage across a whole estate is what we are building with design partners. The financial-services page lays out exactly which is which.

Don't wait for the formalization

Maybe the standards body happens, maybe it stalls. The direction of travel does not depend on this one essay: verification over trust is the theme of every serious AI-governance proposal this year, and financial services is where verification regimes get enforced first. The practical asymmetry is this: an evidence trail is cheap to start collecting today and nearly impossible to reconstruct retroactively. The firms that can already answer "show us what your AI did" will clear whatever arrives in a day. The ones that can't will be reconciling logs across vendors under a deadline.

What this looks like for a regulated firm How we govern ourselves