AI in banking and insurance under KNF supervision

Budgets and AI cost control

Cost and efficiency

Problem: Spending on language models is unpredictable and not assigned to an owner

How it works: Hierarchical budgets per team and project, with a policy for when the limit is exceeded: block, downgrade the model or raise an alert

What you gain: Every zloty spent on AI has an owner and a limit, and exceeding the budget triggers a predefined response

Document analysis with source verification

Knowledge and documents

Problem: Analysing contracts, applications and claims files requires certainty about the source of every piece of information

How it works: A central RAG knowledge base with source preview and a Knowledge Gap Register; OCR of scanned documents

What you gain: The analyst sees which document each piece of information comes from, and the system says plainly when the file lacks a basis

Safe AI work with client data

Security and sovereignty

Problem: Client data must not reach a model outside the organisation

How it works: Model routing based on data sensitivity, detection and masking of personal data, and a predefined Finance sector profile

What you gain: Staff use the best models for general work, and client data goes only to the local environment — automatically

Protecting models against manipulation and abuse

Security and sovereignty

Problem: Clients try to manipulate the model in service channels

How it works: Real-time abuse detection: injection, jailbreak, prohibited content and token-usage anomalies

What you gain: An AI service channel that resists attempts to extract data or bypass the rules — and every attempt leaves a trace

A full audit trail of AI-supported decisions

Compliance and oversight

Problem: The supervisor requires evidence of who authorised an AI-supported decision and on what data

How it works: A cryptographically signed, immutable log of every call (Article 12 of the AI Act) with retention, and a Human Oversight mechanism (Article 14) with approval gates

What you gain: The answer for the supervisor is in the system: who, when, on what data and with what result — without reconstruction

Informed approval of AI-supported decisions

Compliance and oversight

Problem: An employee approves an AI recommendation without really checking it

How it works: Human Competence Gate (CDF-F2) — before a critical decision is approved, the system asks 5–15 check questions; too few correct answers block approval

What you gain: Human oversight stops being a “click approve” fiction — and you can prove it to the auditor

Inventory and risk classification of AI systems

Compliance and oversight

Problem: The regulator asks for an inventory of AI systems and their risk classification

How it works: CDF-F1.5: AI Act readiness assessment, statement of applicability and impact assessment report; PROXY:AI: a register of models and policies and the decision history as material for ISO/IEC 42001

What you gain: An inventory of AI systems with risk classification, ready for the supervisor’s request — kept up to date, not built for an inspection

How can you limit hallucinations in banking applications?

By answering only from approved documents, with a source citation, and through human oversight of the decision. TWIN:DESK answers based on the organization’s documents with a citation, and PROXY:AI lets you route tasks to models proven in a given use case

How do you assess an AI provider and avoid concentration?

By being able to swap the model without rebuilding the process. PROXY:AI provides a single gateway to more than 100 models, both cloud and local. Changing a model is a configuration change, not a new deployment

How do you include an AI provider in the register of ICT contractual arrangements (DORA)?

Like any ICT service provider supporting important functions: with a risk assessment, an exit plan and information on data location. The WORM log in PROXY:AI documents which models processed data and when