As financial institutions rush to integrate artificial intelligence, many are making a critical mistake—adding AI-specific contractual clauses without first understanding the legal and regulatory structures already in place.

Andrew Moyad, CEO of Shared Assessments, argues that the AI "checklist" approach is misguided and risks creating legal and operational blind spots. Instead, he emphasizes the importance of re-evaluating existing GDPR-standard clauses and technical control measures before layering on new AI-specific terms.

Moyad also challenges the assumption that AI needs entirely new governance models. He warns against the activity trap of adding “exhibits and extras” just to appear compliant, rather than designing a contract that reflects the actual risks and realities of AI usage. He notes that in many cases, the real problem lies not with the vendor but with how a company’s own employees are using AI tools—often without appropriate oversight or data governance. This interview pushes the conversation from theoretical compliance to real accountability in an era of automated decision-making.