Paul Merrison

AI governance for financial services

I work on the gap between Model Risk Management frameworks like SR 11-7 and SS1/23 and the actual mechanics of generative and agentic AI systems in production. The interesting questions sit where regulatory expectations meet engineering controls — and most firms are trying to bridge that gap with policy documents alone.

I'm Chief Information Security Officer at Tetrate and a contributor to the FINOS AI Governance Framework, where I received the Newcomer Award at OSFF NYC 2025. I take a small number of fractional advisory engagements with banks, insurers and FS infrastructure firms working through AI governance implementation — and I write about the work here.