3. Govern the components behind the answer
In a conversational interface, the client sees a single response. For the bank, that response comes from a combination of: approved content, product data, client information, regulatory rules, and the language model used to formulate the answer. Treating these as one undifferentiated “AI answer” is where risk begins and opens a larger question every bank now faces: how much of the system should run on an external LLM, and with which data. External models accelerate development and are intuitive to use. They also raise questions a Swiss bank cannot ignore: data protection, outsourcing, client confidentiality, information leakage, auditability, and data sovereignty.
In Deloitte’s experience, this decision is rarely all-or-nothing and treating it as such stalls the project. The more workable framing is narrower: which tasks may use an external model, with which data, under which controls, and for which purposes. Drafting a neutral explanation of what “volatility” means is a different risk decision from letting the same model see a client’s positions and suggest a course of action. Separate those cases explicitly, and the external model question turns from a stand-off between innovation and compliance into a set of manageable choices.