"It's Not My Fault — The AI Did It"
Is Not a Defence

Three different professions. Three different failures. One identical lesson: in every case, the technology was blamed — and in every case, the regulator, the court, and the client held a person accountable.

If you work in compliance, fiduciary services, or fund administration, this article is about the question you will eventually be asked — why did you decide that? — and why "the system said so" has now been tested as a defence, repeatedly, in public, and has failed every time.

Why This Matters Right Now

Three developments make this month the wrong time to look away:

• 2 August 2026 — the EU AI Act's next wave goes live. Transparency obligations under Article 50, including the duty to disclose when users are interacting with AI, apply from that date, with fines for the most serious breaches of the Act reaching €35 million or 7% of global turnover (Latham & Watkins, 2026). A political agreement reached on 7 May 2026 defers the heaviest high-risk system obligations to December 2027 — but the prohibitions and general-purpose AI rules are already in force, and Mauritius structures whose AI outputs are used in EU markets may fall within the Act's extraterritorial reach (Gibson Dunn, 2026).
• FINRA has flagged AI agents as a distinct supervisory concern. Its 2026 Annual Regulatory Oversight Report warns of agents acting autonomously without human validation and approval, acting beyond their intended scope and authority, and defeating auditability — and asks firms to define where "human in the loop" oversight sits before deployment, not after (FINRA, 2025).
• Adoption has outrun understanding. The FCA's chief executive told a techUK audience in June 2026 that over 80% of financial services firms are already using or adopting AI (Rathi, 2026). Yet the Bank of England and FCA's own survey found that only 34% of firms reported a complete understanding of the AI they use — 46% admitted their understanding was partial, particularly where tools came from third-party vendors (Bank of England and FCA, 2024).

That gap — between what firms are using and what they can defend — is where the enforcement of the next five years will happen. Closer to home, the FSC Mauritius saw this coming: its Fintech Series Guidance Notes No. 4 (September 2025) set out nine principles for the responsible use of AI, with accountability resting squarely on boards and senior management for all AI-generated outcomes, whether the tool was built in-house or bought (FSC Mauritius, 2025).

The Evidence: What "The AI Did It" Actually Costs

Read the third column again. And the courts have been pointed about how avoidable it all was: in the Nebraska matter, the Supreme Court noted that the fabrications could have been easily discovered using traditional legal research (Nebraska Public Media, 2026). The check that would have prevented career-ending damage was ordinary professional diligence — the kind every reader of this article already knows how to perform.

To be clear, none of this is an argument against the technology. The FATF itself concluded that these tools can make risk analysis more accurate, timely and comprehensive (FATF, 2021). It is an argument about where responsibility sits when the tools are used — and every case above answers that question the same way.

Gap Analysis: Where Firms Think They Are vs Where Regulators Expect Them to Be

Based on the FSC's nine principles, the Wolfsberg Group's five elements for AI in financial crime compliance, and the FATF's technology guidance, here is the honest gap most firms need to close:

Seven Steps That Survive an Inspection

Concise, sequenced, and none requires a technology budget:

• 1
  Run an AI amnesty this month.Ask every team member to list every AI tool they use for work — no penalties for honesty. The inventory is your foundation; shadow AI is your largest unrecorded risk.
• 2
  Classify each use against risk.Drafting an internal email is not the same as screening a client. Map each tool to the decisions it touches, and apply the FSC's nine principles proportionately (FSC Mauritius, 2025).
• 3
  Name one accountable owner per AI-assisted process.A person, not a department. If no one's name is next to it, the regulator will choose a name for you — usually at board level.
• 4
  Impose a verification rule with no exceptions.Nothing AI-produced enters a client file, a court document, a regulatory filing, or a report bearing your firm's name until a human has checked it against a primary source. This is precisely the rule courts have now enforced over 1,700 times (Charlotin, 2026).
• 5
  Record the reasoning, not just the result."Approved" is an outcome. "Approved because source of funds is evidenced by the audited accounts, the adverse media hit was assessed and discounted as a different individual, and residual risk sits within appetite" — written at the time — is a defence.
• 6
  Treat AI output as evidence, never as a decision.A machine-generated risk score is an input with a provenance, like a bank reference. It informs judgement; it does not replace the human at the decision point (Wolfsberg Group, 2022).
• 7
  Rehearse the question.Once a quarter, pick a closed file and ask the team: if the FSC asked us today why we decided this, what would we show them? If the answer is a system log and silence, you have found your gap while it is still free to fix.

The Skill That Survives the Machines

Here is the uncomfortable truth inside all the cases above: none was caused by bad AI. The models did what they were built to do — produce plausible output at speed. The failures happened in the space between the output and the signature, the space where a professional is paid to think. TD Bank's systems raised flags; humans chose not to fund the follow-up. Deloitte's report looked authoritative; no one checked whether the sources existed. The sanctioned lawyers received perfectly formatted citations; they simply never read them.

In fiduciary practice, I have watched how quickly a well-written summary hardens into an unquestioned fact on a file. Plausibility is the most dangerous quality AI output has — it wears the costume of verified work. The discipline of asking how do we know this? before anything enters a client record was valuable before these tools existed; it is now the difference between a defensible file and an expensive one.

That space — between what the machine produces and what you are willing to sign — is where compliance careers will be made or ended over the next decade. The professionals who let AI do the gathering while keeping the judging, who can show their reasoning in writing, and who can answer why without reaching for the system log, will not merely survive the AI era. They will be the ones regulators trust, boards promote, and clients keep.

The machine will keep getting better at finding things. Deciding what the findings mean — and standing behind that decision — was never the machine's job. It is still yours. That is not a burden. In a profession built on trust, it is the entire point.

This article reflects the author's personal views and general observations on professional practice. It does not constitute legal, regulatory, or professional advice, and does not describe the practices of any specific organisation.

References