AI Governance

In a keynote at the Geneva Association PROGRES-Seminar, EIOPA argued that keeping risks insurable requires earlier risk identification, broader risk sharing, and responsible transformation. The speech introduces no binding requirements. It does signal supervisory focus on private credit and funded reinsurance, natural catastrophe protection gaps, AI and ICT concentration risk, value for money, and a possible shift toward principles- and outcomes-based regulation. Compliance teams should treat it as a forward-looking indicator of supervisory expectations.

The Norway Financial Supervisory Authority has published a warning that relays a UK Financial Conduct Authority (FCA) alert about "PCP Claim Finder (Clone)," an entity apparently impersonating an FCA-authorized firm. Compliance teams should treat this as a clone-firm fraud indicator and update screening, monitoring, and consumer-facing controls accordingly.

The Dutch Data Protection Authority (AP) has established a new directorate to oversee its work on artificial intelligence and prepare for enforcement responsibilities under the European Union's AI Act, even as the legislation needed to grant it those powers remains unfinished.

Britain's privacy regulator has secured changes or commitments to improve data protection practices from ten major artificial intelligence developers, including OpenAI, Google, Microsoft and Anthropic, following scrutiny of how their foundation models are trained and developed.

The Portuguese Data Protection Commission (CNPD) issued an opinion raising significant concerns about Bill 697/XVII/1, which would create a new criminal offense for "digital identity usurpation" under the Cybercrime Law. CNPD finds the proposed definition of "digital identity" overly broad and indeterminate, and highlights substantial overlap with existing offenses (computer forgery, computer fraud, illegitimate access), questioning the necessity and proportionality of the new crime. Compliance teams monitoring Portuguese cybercrime and data protection legislation should track the bill's evolution, as its current drafting could create overlapping liability frameworks and interpretive uncertainty.

Norway's Financial Supervisory Authority (Finanstilsynet) has issued a public warning regarding the unregistered entity operating as "my.aipltfrm.com," echoing an earlier alert from Spain's CNMV. Compliance teams should treat this as a notice of an unauthorized financial services provider with potential cross-border exposure affecting European retail investors.

FinCEN, the Federal Reserve, FDIC, NCUA, and OCC jointly clarified that Suspicious Activity Report confidentiality requirements do not prevent banks from discussing potentially fraudulent transactions, suspicious activity, or account closures with affected customers. This guidance does not change existing BSA obligations or create new supervisory expectations, but it provides clarity that may help banks improve customer communication during fraud investigations while maintaining compliance.