On 18 June 2026 the National Financial Regulatory Administration issued the Guiding Opinions on the Secure Development and Use of Artificial Intelligence in Banking and Insurance, setting out systematic requirements for banking and insurance institutions that develop and use AI.
Why finance moved first with detailed rules
Finance is among the most AI-intensive and risk-sensitive industries. Credit risk control, advisory, customer service and anti-fraud scenarios increasingly deploy models, and the special nature of financial business — involving fund safety, consumer rights and systemic risk — means it cannot be constrained by general rules alone.
So, alongside the CAC’s general governance framework, the sector regulator issued detailed rules closer to financial business. This is another instance of the “general rules plus sectoral detail” two-tier structure in AI. Similar sectoral paths have appeared in human resources and social security, and in transport.
The pillars of the guidance
First, a “full-lifecycle management system”. The guidance requires a full-lifecycle AI management system, meaning management covers not only launch but design, development, testing, deployment, operation and exit. This aligns with the risk-management philosophy emphasised in the AI safety governance framework.
Second, “access management for high-risk applications”. The guidance calls for strengthened access management for high-risk applications — differentiated control by risk tier, with stricter assessment and approval for high-risk scenarios rather than uniform launch.
Third, “data security and personal information protection”. Financial business naturally processes large volumes of personal and sensitive data, and the guidance makes dedicated requirements. Financial institutions often also constitute large personal information processors, with corresponding duties.
Fourth, consumer protection and suitability management. AI in advisory and marketing scenarios must prevent misleading output and improper recommendation, consistent with financial consumer protection requirements.
What it means for financial institutions
First, embed AI governance in existing risk-control systems. Financial institutions already have mature risk management and internal control mechanisms; AI governance should graft onto them rather than being a separate system.
Second, build a risk-tiering and access list. Clarify which AI applications are high-risk and what assessment, approval and monitoring requirements apply, forming an executable list.
Third, connect model output with compliance review. Whether AI output is compliant, explainable and traceable should enter daily monitoring.
Fourth, make data compliance scenario-specific. The boundaries for training data, inference data and customer data differ and must be clarified scenario by scenario.
What it means for AI service providers
The guidance binds financial institutions, but its effects transmit to the technology companies providing AI services to them. As a supplier, you need to show your product meets the client’s compliance requirements — model explainability, lawful data sourcing, security assessment materials and exit mechanisms may all become procurement and access conditions.
This means AI service providers working with financial institutions should prepare a compliance materials pack in advance, making security assessment, data compliance and IP arrangements deliverable documents. For support on financial AI security assessment, data compliance and supplier compliance materials, see our Data Compliance and Commercial Contracts services.
This article is based on public information from the National Financial Regulatory Administration’s Guiding Opinions of 18 June 2026. It is for reference only and does not constitute legal advice.