AI for regulated firms

>_ the gap

"Nearly half of licensees did not have policies in place that considered consumer fairness or bias, and even fewer had policies governing the disclosure of AI use to consumers."

ASIC, first review of AI use by 23 licensees across banking, credit, insurance and financial advice, published October 2024 · 24-238MR

Your people are probably already using AI, approved or not. The question isn't whether to use it. It's whether you decided what it can touch, and whether you could show your working if someone asked.

>_ how I help

Three ways I help.

Independent advice for firms big enough to need a plan and small enough that nobody owns AI full-time.

Find where it pays back

Where AI gives your people real time back, what to do first, and what to leave alone. An honest go or no-go, not a pitch for a build. For example: meeting preparation, file notes, first drafts of client documents, reporting.

Design the guardrails with you

Which tools, what data can go where (including offshore), and who reviews what. I design it with your team; your compliance lead or licensee approves it.

Take work off your leadership team

An independent view on AI decisions as they come up: tools and vendors assessed, rollout order, and plain-English guidance for staff.

>_ where I fit

Your obligations set the rules. The operating decisions are yours.

I work on the operating decisions, inside the rules. Approval stays with whoever owns it today. Where something needs your licensee's or compliance team's input, I'll say so rather than guess.

set by your licensee, regulator or compliance function

Which AI tools are approved for use
What client data may go into them, and where
Compliance and record-keeping standards

decided by your business, where I help

Which workflows to start with, and in what order
How consistent to be across teams and sites
How your people adopt it, and what to measure

>_ how I work

Obligations first, tools second.

The same principles on every engagement.

Start with what you answer to

Your licence conditions or your licensee's policies, and your privacy and record-keeping obligations. Then the tools that fit inside them.

Your people sign off

AI helps prepare the work. Your people review it and sign it off, and the file shows what was done and why.

Know where client data goes

Before anything goes live, you know which systems see client information, where they process it, and on what terms.

Plain English

No hype, and no jargon left unexplained. If AI isn't the right answer for something, I'll say so.

>_ start here

Five questions to answer before choosing any tool.

The questions I'd put to a leadership team first. Not all of them will be answerable straight away, and knowing which ones can't be is useful in itself.

Where are our people already using AI, and is that use approved?
What client information may go into which tools, and where is it processed and stored?
Which parts of our work would give people the most time back if they were faster, without weakening the record?
How consistent are our processes and templates across teams, sites or the businesses we've brought together?
Who owns AI decisions: operations, compliance, technology, or a shared group?

>_ how it starts

A 45-minute conversation.

With whoever owns operations or technology. What you'd usually come away with:

A candidate workflow

One place where AI, or a more consistent way of working, looks likely to give people time back.

The evidence gaps

What you'd need to know to decide whether it's worth doing, and how to find it out.

What needs outside input

Which decisions need your licensee, compliance team or legal adviser before anything moves.

>_ who

Experience from inside regulated firms.

TJ Labs is Tim Johnson. I've spent 25+ years in technology across regulated industries, most recently at Australian Payments Plus, and before that at HSBC and CBA.

My work has sat where the business, the technology and the regulator meet. At AP+, as Head of Technology, Future Payments, I helped shape the initial AI strategy. Before that I led architecture through the consolidation of five payment organisations (NPP, eftpos, BPAY, Beem and ConnectID), and oversaw the alignment of the payment rails to PCI DSS, ISO 27001, SOCI, PFMI and APRA CPS 230. As Head of Architecture at HSBC, I owned the implementation of Australia's Consumer Data Right (open banking), adapting the bank's global architecture to new Australian obligations for sharing customer data, and sat on the Australian industry working group.

Through TJ Labs, I bring that to firms working out how to use AI while meeting the obligations they already carry.

Tim Johnson, Founder

"My worry with AI was people signing themselves up and putting whatever they liked into it. Tim set Claude up properly on our own account, wrote the rules for what goes in and what stays out, and built the shared knowledge base my team now works from. Then he trained Pete and me to run it ourselves. That is the part I would pay for again: he left the capability with us instead of making himself part of it."

Chris Blockley, General Manager Sales, Casella Family Brands · a recent client, outside financial services

>_ let's talk

Book the 45-minute conversation.

Email me a line about your firm and what you'd like to get out of AI, and I'll suggest times.

tim@tjlabs.io → Connect on LinkedIn

TJ Labs provides technology and governance advice. It does not provide legal, compliance or financial product advice, and is not a substitute for your licensee or legal adviser.