Kiteworks pitches AI governance for banks under tightening rules

By AI, Created 4:20 AM UTC, May 21, 2026, /AGP/ – Kiteworks is promoting a data-layer governance framework for banks that want to use AI agents on regulated customer data without increasing compliance risk. The company will present the approach to banking technology, risk and compliance leaders in New York on June 1.

Why it matters: - Banks are under pressure to deploy AI while proving they can control regulated data. - Kiteworks says its Compliant AI framework gives financial institutions a way to govern AI agents at the data layer instead of relying only on model-level guardrails. - The company is targeting rules and expectations tied to SOX, GLBA, SEC disclosure requirements, FINRA supervision, NY DFS Part 500 and OCC third-party risk guidance. - Kiteworks says the approach is meant to reduce regulatory exposure while giving compliance teams faster evidence for audits and reviews.

What happened: - Kiteworks detailed its Compliant AI and Secure MCP Server on May 21, 2026. - The company is presenting the framework to senior banking technology, risk and compliance leaders at the 13th Annual Bank IT USA Conference in New York City on June 1, 2026. - Catia Pereira, director of sales engineering at Kiteworks, is scheduled to present “The AI Data Governance Gap in Banking” at 2 p.m. EDT. - The session is aimed at CISOs, CCOs, CIOs and CROs at regulated financial firms.

The details: - Kiteworks says its system creates authenticated agent identity linked to the human authorizer before any regulated data is accessed. - The platform uses policy-enforced access on every request, not just at connection time. - Kiteworks says agents inherit the rights of the user they represent and cannot exceed them. - The company says the framework protects regulated data with FIPS 140-3 validated encryption at rest and in transit. - Kiteworks says the system keeps data in jurisdiction through sovereignty controls. - The platform creates a tamper-evident audit trail and streams it to a SIEM in real time. - Kiteworks says each AI interaction records who authorized the agent, what was accessed, under what policy, when and with what outcome. - The company says evidence packages can be exported in hours instead of weeks. - Kiteworks says the same control plane covers email, file sharing, SFTP, MFT, data forms, APIs and AI. - The company says that could consolidate five to 10 separate tools into one platform. - Kiteworks says the platform protects more than 100 million end users and thousands of global enterprises and government agencies.

Between the lines: - The pitch reflects a broader shift in financial services: AI adoption is moving ahead of mature governance. - Kiteworks cites research showing 57% of organizations lack a centralized AI data gateway and 7% have no dedicated AI data controls. - The company also cites data showing finance and insurance accounted for 27% of cyberattacks and that the average cost of a financial services data breach reached $6.08 million. - Pereira said model-level guardrails are not enough because they live inside the system being attacked. - Pereira said the control that survives a compromise is the one at the data layer, independent of the model. - The company argues regulators will ultimately want to know who authorized each AI interaction, under what policy and what data was returned.

What’s next: - Kiteworks will use the Bank IT USA conference to pitch the framework directly to banking decision-makers. - Attendees can book time with the Kiteworks team through the meeting request page. - The company says regulated firms are using the four-pillar framework to make AI defensible before regulators require more formal evidence.

The bottom line: - Kiteworks is positioning data-layer controls, not model guardrails, as the safer way for banks to scale AI with regulated data.