Consumer Duty raised the evidential bar on how decisions affecting customers are made and recorded. PRA SS1/23 set expectations on model risk that most firms are still building towards. The EU AI Act adds a risk classification obligation on top of both, and the ICO is clear that automated processing carries its own transparency duties. The awkward part is that these arrive as four separate frameworks with four different vocabularies for what is largely the same underlying control.
We map all four into a single register, then design the controls once. Explainability, audit trails, human review thresholds and model inventory are specified into the architecture rather than retrofitted before an inspection — which is both cheaper and, in our experience, the only version that survives contact with a supervisor.