Service · AI Governance

Governed AI Development

Your team is already using large language models to draft policies, procedures, WSPs, memos — and increasingly to build internal tools. We make that defensible: a written policy, a human review gate, retained prompts and outputs, version control, and an annual AI section in your review file. Operated inside RegReview.

Model-agnostic. Claude, ChatGPT, Gemini, Copilot, or an internal model — we govern the tools you already use. No affiliation or endorsement by any model provider is implied.

Why this is now an exam item

Drafting a supervisory procedure with a general-purpose model creates a books-and-records question: what was the prompt, which model version answered, and who reviewed it before adoption.
A policy or WSP adopted without documented human review is a Rule 206(4)-7 / FINRA 3120 weakness — the procedure exists, but the firm cannot show it was reasonably designed for its own business.
AI capability statements in marketing invite AI-washing scrutiny under SEC 206(4)-1 and FINRA 2210 — claims must match what the tool actually does.
Internal apps and agents built on a model API introduce vendor, data-flow, and model-change risk that belongs in the vendor log and the annual review, not in a developer's head.

The six control points

Model & tool register

Every model, assistant, API, and embedded AI feature logged with purpose, data classification, vendor, and whether its output can reach a client.

Use policy & permitted-use map

A written AI use policy for your registration type that defines which development tasks are permitted, which require reviewer sign-off, and what data may never be entered into a prompt.

Human review gate

No AI-drafted procedure, WSP section, disclosure, or client-facing text is adopted without a named licensed reviewer's sign-off, captured with a timestamp.

Prompt & output retention

Prompts, outputs, model and version identifiers, and reviewer decisions retained as books and records — exportable in an exam or document request.

Change & version control

Model upgrades, prompt-template edits, system-prompt changes, and dataset updates versioned so “what changed and when” is always answerable.

Testing & annual evidence

Pre-deployment validation for internal apps and agents, plus an annual AI section in the 206(4)-7 or 3120 review file, aligned to NIST AI RMF functions.

Service tiers

Priced by how deeply your firm uses AI — from drafting only, to shipping internal tools built on model APIs.

Governed Drafting

Firms using up to three models to draft policies, procedures, memos, and training material.

$249/month

$795 setup

AI use policy and permitted-use map
Model and tool register, refreshed quarterly
Review-gate workflow inside RegReview
Prompt and output retention as books and records
Staff attestation and annual acknowledgment

Included at no charge with Platinum consulting and all CCO Services tiers.

Governed Build

Firms building internal apps, assistants, or agents on a model API.

$599/month

$1,950 setup

Everything in Governed Drafting
Pre-deployment validation and test evidence
Vendor AI diligence (DDQ) per model provider
Model and prompt change log with versioning
Annual AI testing section for the review file

Credited 50% against Platinum consulting.

Enterprise AI Oversight

Multi-entity or dual-registrant firms with several build teams.

$1,250/month

$4,500 setup

Everything in Governed Build
Unlimited models and use cases
Model-risk committee support and charter
Board and CCO reporting pack
Exam-ready AI evidence binder

Scoped by entity structure, model count, and build volume.

Scope boundaries

We do: govern, supervise, document, and test the AI your firm uses in compliance and development work, and maintain the policy, register, review gate, and evidence file. We do not: administer AI tenants, provision seats, configure or fine-tune models, write your application code, or harden your network — that stays with your IT provider, MSP, or development team.

FAQ

Can we use Claude or ChatGPT to write our compliance procedures?

Yes — with a governed process. The model can draft; a licensed reviewer must adapt the draft to your business, approve it, and leave a record. Governed AI Development supplies the policy, the review gate, and the retained prompt/output evidence so an examiner can see how the procedure was produced and who owned the judgment.

Do you require us to use a particular AI model?

No. FIN Group is model-agnostic. We govern the tools your firm already uses — Claude, ChatGPT, Gemini, Copilot, an internal model, or AI features embedded in software you already license. We are not affiliated with, endorsed by, or certified by any model provider, and nothing about this service implies an integration or partnership.

What do regulators actually expect right now?

A written AI use policy, an inventory of the tools in use, evidence of human supervision over AI-assisted output, retention of the records the process generates, and coverage of AI in the annual compliance review. That is the same skeleton as any other supervisory control, applied to AI.

We're building an internal tool on a model API. Is that in scope?

Yes — that is Governed Build. We add pre-deployment validation, vendor AI diligence on the model provider, a change log covering model and prompt versions, and an annual AI testing section for your review file. We govern and document the build; we do not write your application code or administer your AI tenants.

How is this different from RegReview's AI Governance capability?

RegReview's AI Governance is the platform layer — the register, policy library, attestations, and evidence trail. Governed AI Development is the service tier that operates it for you and extends it to development work: procedure drafting, WSP authoring, and internal apps built on LLMs.

Put a governed process around the AI your team already uses.

Policy, review gate, retention, and annual evidence — set up in weeks, not quarters.