For a global investment bank, the regulatory landscape is a complex web. The EU AI Act doesn't just add another layer; it intertwines with existing mandates like GDPR and financial risk principles, creating new compliance challenges. The core issue is that these regulations were designed in different eras for different purposes, yet now they govern the same systems.

A trading algorithm, for instance, is simultaneously a data processing engine under GDPR, a potential source of systemic risk under banking regulations, and a high-risk AI system under the AI Act. The key is to map these overlapping obligations onto specific banking functions.

This mapping reveals the tension. An AI model used for credit scoring must have its inputs governed by strict data quality and aggregation rules, a concept familiar from BCBS 239 principles. However, the AI Act now requires extensive documentation on the model's training data, performance, and risk management—going a step beyond.

The interplay between GDPR and the AI Act is most acute when dealing with data for model training. GDPR governs the lawful basis for processing personal data, while the AI Act mandates high-quality, relevant training data for high-risk systems. This creates a dual requirement: not only must you have the right to use the data, but you must also prove its suitability and lack of bias for the AI's purpose. This is the challenge of data provenance in a regulated environment.

This becomes exponentially more complex for cross-border operations. A JPMC team in London might develop an AI model using anonymized transaction data from clients in both the EU and the U.S. While GDPR's Standard Contractual Clauses (SCCs) might permit the data transfer, the AI Act adds another hurdle. The system itself, if deployed in the EU, must conform to the Act's standards, regardless of where the data originated or where the model was trained.

Financial regulations already demand extensive reporting on risk models. The Federal Reserve's SR 11-7 guidance on model risk management is a prime example. The EU AI Act effectively codifies and expands these principles for a broader range of AI systems.

For automated financial decisioning, this means a shift in accountability. If a high-risk algorithmic trading system causes market disruption, regulators won't just look at the trading logs. They will demand to see the AI system's risk management framework, conformity assessments, and records of human oversight as required by the Act. This creates a direct link between a model's technical behavior and the firm's legal and regulatory obligations.

Ultimately, compliance requires a unified governance framework. Data teams, legal departments, and risk officers can no longer operate in silos. The data pipeline that feeds a trading model must be built with GDPR, BCBS 239, and the AI Act in mind from day one. This proactive, integrated approach is the only way to navigate the converging paths of data, AI, and financial regulation.