Six Weeks to Go-Live, Three Regulators
Meridian Financial is deploying an AI-assisted customer screening tool across three jurisdictions. One regulator requires that every adverse screening decision be reviewed by a named human reviewer, with the reviewer's identity and rationale retained for seven years. A second jurisdiction requires customer data to remain in-country. A third has no explicit rule, but group policy applies the stricter standard globally. Go-live is in six weeks. Three weeks ago a business unit raised a change request to (a) host the scoring model in a region outside the customer's jurisdiction to reduce latency, and (b) cut retention of screening logs from 24 months to 90 days to reduce storage costs by about $60,000 a year. The vendor contract describes the vendor as a processor, but the vendor's support team in practice triages flagged cases. Last year's internal audit raised a finding that no data protection impact assessment had been completed for a similar tool; that finding is still open.
1. How should the change request be handled? Set out the decision path and who must be involved.
Read the worked answer
Treat it as two changes, because they carry different risks.
Decision path:
- Log and split the request into (a) hosting relocation and (b) retention reduction - different owners, different regulators.
- Impact assessment covering data residency in jurisdiction 2 (a residency rule is a legal constraint, not a latency trade-off), human review and reviewer-identity retention in jurisdiction 1, the seven-year retention rule, and the group policy applying the strictest standard globally. On that basis the 90-day proposal fails for at least two of the three jurisdictions before any cost discussion.
- Consult and record: DPO/legal, compliance, the internal audit owner of the open finding, and vendor management. A DPIA is required for the changed processing.
- Decide at the right level. A PM cannot accept a regulatory deviation. The options are reject, modify, or defer pending a documented legal opinion.
- Resolve the vendor role. 'Processor' on paper while triaging flagged cases may make the vendor a controller or joint controller for that activity - that needs contractual and DPIA resolution before go-live, not after.
Likely outcome: the latency objective is achievable through a regional edge cache or in-region deployment without moving data; the retention reduction should be rejected and the storage cost solved another way. Frame it as 'here is how we meet the latency goal', not simply 'no'.
2. What must exist and be evidenced before go-live, and what does the open audit finding change?
Read the worked answer
Must exist and be evidenced:
- A completed, signed DPIA for this tool, with the audit finding formally closed.
- A record of processing activities covering the vendor and in-region hosting.
- Human-in-the-loop review configured and tested, retaining reviewer identity, timestamp and rationale for the statutory period - evidenced by a test extract, not a screenshot.
- Data residency evidence for jurisdiction 2: where data is stored, replicated, backed up and supported from. Remote support access from outside the region is itself a residency event.
- Updated vendor contract covering processor obligations, sub-processor list, breach notification timeline and audit rights.
- Retention schedule per jurisdiction enforced by system configuration rather than procedure.
- Reviewer training records and a documented appeal route for adverse decisions.
- Go/no-go sign-off from the accountable executive, compliance and the DPO.
What the open finding changes: it shifts the burden of proof. An unresolved finding means the organisation has already been told the control is missing. Repeating the gap turns a compliance issue into a governance failure with personal accountability for those who proceeded. Closure therefore requires evidence of the control operating, not a statement that it will.
3. A sponsor says: legal always says no, ship it and we will document afterwards. How do you respond, and what do you do if the instruction is repeated in writing?
Read the worked answer
Immediate response: state the constraint plainly, without theatre - 'I can't ship this and document it afterwards; human review and retention are conditions of operating, and a review record cannot be retrofitted once decisions have been made without one.' Then offer the path that gets most of what the sponsor wants: a phased go-live in the jurisdictions without the human-review requirement, or a manual review workflow that satisfies the control while the automated tool finishes assessment.
If repeated in writing, do not simply refuse:
- Reply in writing referencing the specific requirement and the open audit finding.
- Ask that the instruction be recorded as a risk acceptance by the accountable executive, with compliance copied. Most requests stop at this point.
- Escalate through the compliance and audit line - a regulator-facing control is not the PM's risk to accept.
- Record the exchange in the decision log, including the options offered.
Framing matters. 'Legal always says no' is a complaint about a function; 'here is the requirement, here is the cost, here is the option that moves us forward' is a decision. If the organisation genuinely wants to change the control, that is a policy decision for the accountable executive, taken with legal advice and documented - which is categorically different from skipping it quietly and hoping the regulator does not ask.