AI Governance in Fraud Detection

When European lawmakers drafted GDPR's provisions on automated decision-making, few anticipated how rapidly AI would transform fraud detection. The requirement for "meaningful information about the logic involved" seemed manageable when rules were straightforward. Five years later, as neural networks and ensemble models increasingly drive transaction approvals, those provisions carry real weight. With the EU AI Act set to classify fraud detection as "high-risk AI," financial institutions face a fundamental shift in how they select, deploy, and govern their critical security infrastructure.

The Right to Explanation Under GDPR

GDPR does not explicitly mandate a full "right to explanation," but it establishes key principles requiring AI decisions to be transparent and contestable:

• Article 22(1): Consumers have the right not to be subject to decisions based solely on automated processing if those decisions have significant legal effects.
• Articles 13, 14 & 15: Organisations must provide "meaningful information" about how automated systems reach decisions, including their logic and significance.
• Article 22(3): AI-driven decisions must include the option for human review and challenge.

Key takeaway: Fraud detection vendors must ensure transparency in how their systems reach decisions. Financial institutions must provide clear channels for disputing flagged transactions.

How the EU AI Act Expands These Requirements

Unlike GDPR, which broadly applies to data processing, the AI Act directly regulates AI models, particularly high-risk applications in financial services. Fraud detection is not explicitly listed under Annex III (Article 5(b)), but it falls under regulatory scrutiny through three routes:

1. Article 6(2): High-Risk AI by Regulatory Obligation

   • AI used in fraud detection is subject to PSD2 (RTS-SCA) and AMLD6 compliance.
   • Because these regulations mandate fraud prevention measures, AI used in these processes qualifies as high-risk AI under the AI Act.

2. Recital 38: Financial and Consumer Protection Risks

   • AI systems affecting financial security and consumer rights fall within the AI Act's remit.
   • Fraud detection AI influences access to financial services and transaction security, bringing it under enhanced oversight.

3. Explainability, Bias and Oversight Requirements

   • AI vendors must document how their models reach decisions so financial institutions can meet explainability standards.
   • Models must be tested for bias and fairness to prevent discrimination.
   • Human intervention processes must be defined and regularly audited.

Key takeaway: Issuers and payment providers must treat fraud detection AI as high-risk, requiring stronger governance, documentation, and bias monitoring.

The UK's "Innovation-First" Approach: Will It Diverge?

The UK has taken a lighter regulatory stance on AI than the EU but remains closely aligned:

• The UK AI White Paper (2023) prioritises pro-innovation principles but encourages sector-specific regulators (like the FCA) to enforce AI transparency and accountability.
• The FCA & BoE AI Discussion Paper signals that AI oversight in financial services will likely mirror EU requirements.
• The UK avoids the prescriptive high-risk classification of the AI Act, but financial AI models will face similar governance scrutiny.

Key takeaway: UK issuers should prepare for AI explainability and risk governance frameworks, even if formal "high-risk" classification is less explicit.

Selecting AI Vendors: Key Governance Questions

Smart Rules

• Transparency and Documentation:

  • Can vendors provide audit trails explaining rule-based fraud detection decisions?
  • Are rule modifications documented and traceable for regulatory reporting?

• Adaptability:

  • Can smart rules adjust dynamically to evolving fraud patterns whilst maintaining compliance?

AI Models

• Explainability and Fairness:

  • What level of model interpretability does the vendor provide for regulators and auditors?
  • How are models tested for bias and discrimination?

• Performance and Oversight:

  • How does the vendor monitor AI model performance over time to prevent accuracy degradation?
  • What human oversight mechanisms are built into the decision-making process?

• Regulatory Compliance and Flexibility:

  • Can the vendor adapt models quickly to meet evolving EU and UK regulations?
  • Do they support regulatory impact assessments (DPIAs and AI risk assessments)?

Conclusion

Financial institutions cannot treat fraud detection AI as a black box. Explainability, fairness, and human oversight are now regulatory imperatives. The EU AI Act formalises these governance requirements; the UK maintains flexibility but will likely align over time. Vendors must provide documentation, bias mitigation, and compliance-ready governance. Issuers must hold them accountable. Financial institutions that assess their AI strategies now, before enforcement tightens, will be better positioned than those that wait.