AI Governance for Customer Communications in Financial Services

AI governance in financial services cannot stop at the model. It must extend to the statements, notices, credit explanations, emails, chatbot responses, personalized messages, and other communications that customers actually receive.

The need is becoming more immediate as AI use expands across financial institutions. In the 2024 Bank of England and FCA survey, 75% of responding financial-services firms were already using AI, while another 10% planned to adopt it within three years. In the same 2024 survey, foundation models, including large language models, already represented 17% of reported AI use cases.

For institutions operating across Latin America, the governance challenge is particularly complex. Countries are developing different approaches to data protection, automated decision-making, AI risk, transparency, and accountability. The practical question is therefore not simply, "Is our AI governed?" It is also, "Can we govern what the customer ultimately sees, receives, and relies on?"

Quick Summary

AI governance for customer communications connects AI controls to the actual messages and documents customers receive. A practical framework should govern the full path from approved data and AI systems through content generation, review, delivery, evidence retention, accessibility, monitoring, and escalation.

For financial institutions, that means:

• Identifying every customer communication that AI creates, modifies, selects, summarizes, translates, personalizes, or influences.
• Applying stronger controls as the potential impact on the customer increases.
• Governing accuracy, privacy, fairness, security, explainability, accessibility, auditability, and human oversight together rather than in separate silos.
• Preserving sufficient evidence to reconstruct how a material communication was produced and delivered.
• Mapping controls to each relevant Latin American jurisdiction instead of assuming there is one regional AI regime.
• Connecting AI policies to the systems that actually generate and distribute customer communications.

This matters in Latin America because AI usage is already substantial. In 2025, Latin America and the Caribbean accounted for 14% of worldwide visits to AI solutions despite representing about 11% of global internet users.

What Is AI Governance for Customer Communications?

AI governance for customer communications is the set of policies, controls, roles, and evidence used to manage how AI influences messages sent to customers. Financial institutions should apply it whenever AI generates, edits, personalizes, selects, summarizes, recommends, translates, or routes information that ultimately reaches a customer.

This approach builds on broader AI risk-management principles. The NIST AI Risk Management Framework is designed to help organizations manage risks and incorporate trustworthiness considerations into the design, development, use, and evaluation of AI systems.

Customer Communications Management, or CCM, is the discipline and technology used to design, generate, personalize, deliver, and manage customer-facing communications across channels. DocPath describes CCM as software for designing, generating, personalizing, and delivering the documents and messages an organization sends to customers across different channels.

That distinction is important because AI may influence a communication without being the system that actually sends it. Consider several examples:

• An AI assistant drafts a rate-change notice that a compliance officer approves.
• A model summarizes transaction activity before it appears in an account statement.
• An AI system translates a loan communication into another language.
• A recommendation engine chooses which offer appears inside a monthly statement.
• A chatbot explains why a payment was rejected.
• A model generates an explanation for an automated credit decision.
• An AI assistant suggests a collections response that an employee sends.

In each case, the governance question should extend beyond the underlying model. Institutions also need to control the data, approved source material, generated content, mandatory disclosures, review process, final document, delivery channel, and evidence retained after delivery.

For a broader framework around the communication layer itself, see DocPath's customer communications governance guide for regulated industries.

Where Does AI Affect Customer Communications in Financial Services?

AI can affect customer communications even when it never communicates autonomously with the customer. If AI drafts, summarizes, translates, recommends, classifies, personalizes, or supplies information used in a customer-facing message, the use case belongs in the governance inventory.

This broader definition prevents a common blind spot. A bank might tightly govern an autonomous chatbot while applying far fewer controls to an internal generative AI tool that drafts thousands of customer letters. Yet both systems can affect what customers understand about their accounts, rights, obligations, or financial options.

An AI influence map should cover at least:

• Customer-service responses
• Account statements and summaries
• Credit and eligibility explanations
• Claims communications
• Fraud and transaction alerts
• Collections notices
• Product recommendations
• Personalized marketing
• Mandatory regulatory notices
• Translation and localization
• Document summarization
• Chatbots and virtual assistants
• Employee agent-assist systems
• Generated or personalized financial education content

The scale of indirect AI use is already significant in financial services. In the 2024 Bank of England and FCA survey, 55% of reported AI use cases involved some automated decision-making, although only 2% were described as fully autonomous. This distinction reinforces why governance should focus on how AI influences outcomes, rather than using autonomy as the only trigger for oversight.

Is AI-assisted content lower risk than autonomous communication?

AI-assisted content is often lower risk than fully autonomous communication, but human involvement does not automatically make a use case safe. Human review is meaningful only when reviewers have sufficient information, expertise, authority, and time to identify and correct problems.

A useful risk continuum is:

1. Draft only: AI proposes content that must be independently reviewed.
2. AI-assisted: AI modifies, summarizes, translates, or recommends content inside a controlled workflow.
3. Human-approved automation: AI produces the communication, but defined categories require explicit approval.
4. Automated communication: AI-driven content can be released automatically within predefined limits.
5. Autonomous interaction: AI dynamically communicates or acts without prior human review of each message.

Risk does not necessarily rise in a perfectly straight line across those five levels. A low-impact FAQ response can be less consequential than a human-approved credit explanation containing inaccurate information. The key variables are customer impact, data sensitivity, regulatory significance, reversibility, and the ability to detect errors before harm occurs.

The Financial Stability Board identifies third-party dependencies, cyber risk, model risk, data quality, and governance among the AI-related vulnerabilities requiring attention in financial services.

What AI Risks Must Financial Institutions Govern?

Financial institutions need to govern more than hallucination. Customer-facing AI can create interconnected risks involving accuracy, privacy, fairness, security, explainability, accessibility, third parties, regulatory requirements, operational resilience, and the institution's ability to prove what happened.

The Financial Stability Board identifies third-party dependencies and service-provider concentration, cyber risks, model risk, data quality, and governance as AI-related vulnerabilities that may increase systemic risk. The Financial Stability Institute also identifies hallucination, model governance, data governance, expertise, and third-party AI providers as areas requiring regulatory attention.

A practical customer-communication risk taxonomy should include:

Third-party exposure deserves particular attention. In the 2024 Bank of England and FCA survey, 33% of reported AI use cases were third-party implementations, compared with 17% in the regulators' 2022 survey.

Governance maturity can also differ from adoption. In the same 2024 financial-services survey, 84% of responding firms had an individual accountable for AI, but only 34% reported a complete understanding of the AI they used and 46% reported only partial understanding.

If AI is already influencing communications across multiple systems, the next step is to bring the communication layer under the same governance discipline. DocPath's document-management platform manages the customer document lifecycle across design, generation, multichannel delivery, signing, and archiving.

To discuss how that could fit an existing financial-services architecture, contact DocPath.

Which Latin American AI and Data Rules Matter?

Latin America does not have one unified AI governance regime. Financial institutions need a jurisdiction-specific obligations map combining data-protection law, AI-specific rules where they exist, financial-sector requirements, consumer protection, and internal risk standards.

The regional direction is becoming clearer even though national approaches remain different. In 2025, generative AI represented 78% of measured visits to AI solutions in Latin America and the Caribbean, compared with 74% globally.

That level of usage makes it increasingly important for financial institutions operating across multiple markets to distinguish the rules that already apply from regulatory initiatives that are still evolving.

The correct approach is therefore not to create one "LATAM compliance checklist" and assume it applies everywhere. A regional financial institution can establish one common governance architecture, but the obligations, customer rights, approval thresholds, retention rules, disclosures, and escalation requirements should be mapped by jurisdiction and use case.

For a closer look at the communication-specific side of this problem, DocPath's guide to compliant banking customer communications in Latin America covers data protection, accessibility, multichannel delivery, and document governance.

What Controls Should an AI Communication Governance Framework Include?

A practical AI communication framework should connect governance to eight control areas: use-case inventory, data, models and vendors, customer content, human oversight, testing, delivery, and evidence. Controls should become stronger as the potential impact on the customer increases.

This is where financial institutions need to translate high-level responsible-AI principles into production rules. ISO/IEC 42001 specifies requirements for establishing, implementing, maintaining, and continually improving an AI management system, while the NIST AI RMF provides a framework for managing AI risks throughout the lifecycle.

What should be governed before content is generated?

Before AI produces customer-facing content, institutions should control which use cases are permitted, which models and providers can be used, what data they may access, and which sources they are allowed to rely on.

A pre-generation checklist should include:

• Register the AI use case and its business owner.
• Assign a customer-impact classification.
• Approve the model, provider, and deployment environment.
• Define permitted customer data.
• Apply data-minimization rules.
• Identify authoritative knowledge sources.
• Version system instructions and material prompts where appropriate.
• Document vendor dependencies.
• Establish prohibited uses.
• Set escalation and fallback requirements.

This stage is particularly important for generative AI because risk can arise from the model, data, application design, human use, and external dependencies together. NIST's Generative AI Profile provides recommended actions for governing, mapping, measuring, and managing generative AI risk across its lifecycle.

What should be governed when content is created?

During generation, controls should constrain what the AI can say, what it cannot change, what requires review, and what information must come from authoritative systems rather than unconstrained generation.

Financial institutions should consider:

• Approved reusable content blocks
• Locked mandatory disclosures
• Retrieval from controlled knowledge sources
• Rules for calculations and account-specific values
• Personalization boundaries
• Prohibited representations or promises
• Tone and language standards
• Human-review thresholds
• Localization rules
• Automated escalation when confidence or required information is insufficient

The principle is simple: content carrying legal, financial, contractual, or customer-rights implications should use deterministic rules or approved content wherever these offer stronger control than unconstrained text generation.

What should be governed after content is generated?

Governance should continue after generation through version control, channel consistency, accessibility, delivery evidence, retention, incident monitoring, and customer-complaint handling.

The final record may need to connect:

• Final customer-visible output
• Template and content version
• Relevant model or workflow version
• Approval record
• Delivery channel
• Delivery status
• Accessibility validation
• Exceptions
• Complaints or disputes
• Subsequent corrections

A CCM platform can be useful at this point because the communication must move from an AI or business process into a controlled document and delivery workflow. DocPath integrates with a range of insurance, ERP/CRM, business-management, and core-banking platforms to support customer communications, document generation, workflows, and omnichannel processes.

How Do You Implement AI Governance Step by Step?

Start with the communication workflow, not the model. Map every point where AI influences customer content, classify its potential impact, assign ownership, establish controls, test the complete workflow, release it under defined conditions, and monitor it continuously.

A seven-step implementation model keeps governance tied to actual production processes instead of leaving it as a policy document.

Step 1 to Step 3: Map, classify, assign

The first three steps establish what is being governed, how consequential it may be, and who owns the outcome. Without those three elements, later controls become difficult to apply consistently.

Step 1: Inventory AI touchpoints.
Map every process in which AI creates, modifies, recommends, translates, summarizes, prioritizes, or selects information that may reach a customer. Include employee-facing tools, not just customer-facing chatbots.

Step 2: Classify customer impact.
A simple internal tier might distinguish low, moderate, and high-impact communication use cases. Classification should consider financial consequences, legal effects, sensitivity of the data involved, vulnerability of the affected customer, regulatory importance, reversibility, and whether errors can be detected before delivery.

Step 3: Assign accountability.
Every use case should have a named business owner as well as defined responsibilities across compliance, legal, data and model governance, technology, information security, and customer communications.

A simple RACI model can help:

The exact responsibilities should reflect the institution's existing governance model. The important requirement is that accountability remains explicit rather than distributed so widely that no one owns the final customer outcome.

Step 4 to Step 7: Control, test, release, monitor

Once the use case has an owner and risk classification, the institution should define operational boundaries, test against them, release only after acceptance criteria are met, and monitor changes that could invalidate the original approval.

Step 4: Set data and content boundaries.
Define authoritative sources, permitted personal data, mandatory disclosures, prohibited content, calculation rules, personalization limits, and situations where the system must refuse or escalate.

Step 5: Set approval and human-oversight rules.
Specify which communications may be released automatically and which require explicit human review. Higher-impact outputs should generally face tighter approval and escalation requirements.

Step 6: Validate before release.
Test factual accuracy, data use, privacy, security, fairness, regulatory wording, localization, channel rendering, accessibility, failure modes, and escalation behavior.

Step 7: Monitor and retain evidence.
Track model changes, prompt or workflow changes, exceptions, customer complaints, quality failures, vendor updates, regulatory developments, and unexpected outcomes after deployment.

The NIST AI RMF is intended to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI systems, while ISO/IEC 42001 treats AI governance as an ongoing management system that organizations establish, maintain, and continually improve.

How Should AI-Generated Customer Communications Be Tested?

Testing should evaluate the final customer communication, not only the AI model. Financial institutions need predefined acceptance criteria for accuracy, privacy, required content, fairness, security, accessibility, channel consistency, and escalation before production.

A technically strong model can still produce a weak customer outcome if the wrong source data enters the workflow, a mandatory disclosure is omitted, a channel breaks document formatting, or a template introduces inaccessible structure.

What should pre-release testing cover?

Pre-release testing should reproduce realistic customer scenarios and deliberately test failure conditions. The goal is to establish whether the complete communication workflow remains within its approved boundaries.

A minimum test checklist can include:

• Factual accuracy: Are generated explanations supported by approved information?
• Customer data: Is the correct data used for the correct customer and purpose?
• Calculation consistency: Do amounts, rates, dates, and totals match authoritative systems?
• Mandatory content: Can AI remove or materially alter required wording?
• Hallucination: Does the system invent products, policies, terms, or reasons?
• Privacy: Can sensitive information appear in the wrong output or logs?
• Fairness: Do comparable customers receive unjustifiably different treatment?
• Security: Can prompt injection or malicious input alter protected behavior?
• Localization: Are language and jurisdictional variants correct?
• Accessibility: Does the final document retain semantic structure and usability?
• Channel rendering: Does the same communication remain accurate across PDF, email, mobile, web, print, or messaging channels?
• Escalation: Does the system hand off cases it is not authorized to resolve?

No universal pass rate is appropriate for every use case. Acceptance criteria should reflect the risk classification, regulatory requirements, internal policy, and the consequences of failure.

What should be monitored after deployment?

Production monitoring should detect whether the model, source data, vendor, prompt, policy, template, communication channel, or customer behavior has changed enough to invalidate the original assessment.

Monitor at least:

• Output-quality trends
• Customer complaints
• Human overrides
• Escalation rates
• Data-quality changes
• Model and provider updates
• Prompt and workflow changes
• Unexpected customer outcomes
• Accessibility failures
• Delivery failures
• Security incidents
• Regulatory changes

NIST's Generative AI Profile treats AI risk management as a lifecycle activity and provides recommended actions across the Govern, Map, Measure, and Manage functions.

For institutions trying to convert governance requirements into repeatable production workflows, DocPath's CCM guide for enterprise organizations explains how centralized communications, templates, document generation, delivery, and governance fit into the broader enterprise document environment.

If your challenge is moving AI governance from policy into controlled customer communications, contact DocPath to discuss the architecture and workflows involved.

What Evidence Should Be Logged for AI Governance?

A financial institution should be able to reconstruct how a material customer communication was created, approved, delivered, and changed. The audit record should preserve enough information to demonstrate accountability without turning logging into indiscriminate retention of personal data.

A practical minimum record can include:

• AI use-case identifier
• Business owner
• Customer-impact or risk classification
• Model and provider
• Relevant model version
• Material system or prompt version where appropriate
• Approved source or knowledge-base version
• Communication template and version
• Mandatory content rules in force
• Approval or exception record
• Final customer-visible output
• Channel used
• Delivery event and status
• Accessibility validation where applicable
• Policy version in effect
• Linked incident or complaint
• Material model, vendor, data, or workflow changes

This evidence model supports two different questions. First, "What happened?" Second, "Was the approved process followed?"

Data minimization still matters. Brazil's LGPD establishes principles governing the processing of personal data and rights available to data subjects, while Mexico's private-sector data-protection framework establishes principles and rights governing the processing of personal data. An institution should therefore preserve the evidence required for accountability while avoiding unnecessary replication of sensitive customer data.

This operational link between document version, approval, delivery, and archive is also central to DocPath's customer communications governance framework.

How Does Accessibility Fit Into AI Governance?

Accessibility is a governance requirement for the final customer experience, not merely a formatting task performed after generation. An AI-generated communication can be factually correct while still excluding customers if its document structure, reading order, tables, images, navigation, or digital presentation are inaccessible.

The scale of the issue is substantial. In 2023, the World Health Organization estimated that 1.3 billion people, representing 16% of the global population, experienced significant disability.

For customer communications, two standards are particularly important to distinguish.

PDF/UA is the ISO 14289 family of standards covering accessible PDF documents. It establishes technical requirements intended to make PDF content and structure usable with assistive technologies.

WCAG 2.2 became a W3C Recommendation on October 5, 2023 and added nine success criteria compared with WCAG 2.1. WCAG focuses primarily on accessibility of web content.

They overlap in purpose but should not be treated as interchangeable standards.

For AI-assisted financial communications, accessibility controls should include:

• Preserve semantic headings and document structure.
• Maintain logical reading order.
• Provide appropriate alternative text where needed.
• Ensure tables carry usable structural information.
• Define the document language correctly.
• Test keyboard and assistive-technology interaction where relevant.
• Validate accessibility after AI-driven content changes.
• Prevent generated content from breaking approved accessible templates.
• Include accessibility in pre-production and regression testing.

An accessible-by-default workflow is often easier to govern than a remediation process that tries to identify which individual recipients may require accommodation.

DocPath states that its platform supports scalable creation of accessible PDFs and integrates accessible document generation into existing workflows. More detail is available in DocPath's accessibility and inclusion resources.

What AI Governance Mistakes Should Financial Institutions Avoid?

The most damaging governance gaps often appear when AI is treated as an isolated model problem. Customer communications depend on data, models, templates, workflows, people, delivery channels, accessibility, evidence, and external providers working together.

Several mistakes are particularly important to avoid.

1. Governing the model but not the communication.
A model may pass internal validation while the final PDF, email, chatbot response, or app notification still contains the wrong disclosure, data, translation, or explanation.

2. Treating every AI use case as equally risky.
A system summarizing an internal meeting and a system explaining a credit decision should not automatically face identical controls.

3. Treating human review as a complete safeguard.
A reviewer who lacks context, authority, or adequate time can become a procedural checkbox rather than a meaningful risk control.

4. Failing to inventory indirect AI use.
Agent-assist tools, translation tools, summarizers, recommendation systems, and document-generation assistants may influence customer content without appearing in a list of "customer-facing AI."

5. Allowing sensitive customer information into unapproved AI systems.
Data governance needs to define which environments, vendors, and use cases may process customer information.

6. Failing to version material components.
If an institution cannot identify the model, prompt, source, policy, template, or content version involved in a disputed communication, investigation becomes significantly harder.

7. Allowing AI to rewrite mandatory disclosures freely.
Required wording is usually better governed as approved content rather than unconstrained generated text.

8. Testing the model but not each delivery channel.
Correct content can become incomplete, inaccessible, or misleading after rendering or channel conversion.

9. Ignoring vendor and model updates.
A third-party system may change even when the institution's own application code remains untouched. The Financial Stability Board identifies third-party dependencies and service-provider concentration as important AI-related vulnerabilities in finance.

10. Treating accessibility as post-production remediation.
When accessibility is built into templates and generation rules, it can be tested systematically before distribution.

11. Having no escalation path.
Systems need explicit behavior for uncertainty, missing information, unusual customer circumstances, and requests outside their approved scope.

12. Confusing proposed regulation with current law.
This is especially important in fast-moving jurisdictions. Brazil's PL 2338/2023 remains under consideration in the Chamber of Deputies and is currently listed as awaiting the rapporteur's opinion in its special commission.

13. Keeping too little evidence.
An institution should be able to reconstruct material communications and the process used to generate them.

14. Keeping too much data simply "for audit."
Auditability should be designed alongside privacy and retention rules, not used as a justification for indefinite or excessive data collection.

How Can CCM Operationalize AI Governance at Scale?

An AI governance policy defines what should happen. A governed customer-communications layer can help make those requirements repeatable in production by controlling templates, content, permissions, workflows, versions, channels, accessibility, and communication evidence.

A useful architecture separates five layers:

Customer and core data → Governed AI → Approved communication layer → Delivery channel → Customer and evidence record

The AI layer may create or recommend content, but the communication layer determines whether that content can become an official customer interaction.

This creates several opportunities for operational control:

• Approved templates: AI content enters a controlled layout and document structure.
• Mandatory content: Required language can remain locked or rules-driven.
• Permissions: Defined users and roles control template and content changes.
• Version control: The institution can identify which communication logic was active at a specific point in time.
• Approval workflows: Higher-risk content can require additional review.
• Omnichannel consistency: Rules can apply across supported communication channels.
• Accessibility: Accessible document requirements can be integrated into templates and generation.
• Communication history: The final output and relevant delivery information can form part of the governance record.
• Integration: The communication layer can consume controlled information from core banking, CRM, ERP, claims, or other enterprise systems.

DocPath's document-management platform covers the lifecycle of customer documents from design and generation through multichannel delivery, signing, and archiving, while its integration layer connects with a range of insurance, ERP/CRM, business-management, and core-banking platforms.

This does not mean a CCM platform replaces an institution's AI governance framework, validates the underlying model, or guarantees regulatory compliance. It means the communication layer can become one place where governance requirements are translated into repeatable controls over what customers actually receive.

That distinction is increasingly important in Latin America. In the 2025 fAIr Tech Radar study, the regional average for responsible AI maturity was 2.9 on a five-point scale, with the study identifying stronger technical adoption alongside gaps in governance and social responsibility.

The practical challenge is therefore not just to adopt AI, but to connect adoption to accountable production processes.

For financial institutions already using AI in customer-facing workflows, the next question is whether those workflows are controlled all the way to the final customer communication.

Contact DocPath to discuss how centralized document generation, governed templates, integrations, accessible output, multichannel delivery, and communication traceability can support that operating model.

Frequently Asked Questions

What is AI governance in financial services?

AI governance in financial services is the system of policies, responsibilities, controls, testing, monitoring, and evidence used to manage AI across its lifecycle.

The NIST AI Risk Management Framework provides a voluntary framework for incorporating trustworthiness considerations into the design, development, use, and evaluation of AI systems. In financial institutions, governance should also account for customer impact, privacy, model risk, security, fairness, explainability, third-party dependencies, and applicable regulatory requirements.

The exact control framework should reflect the use case. An internal productivity assistant and an AI system influencing a customer's access to credit may sit inside the same governance program while requiring very different levels of oversight.

Does AI governance apply if a human approves the final message?

Yes. Human approval can reduce risk, but it does not remove the need to govern the AI system, source data, content rules, testing, security, and audit trail.

Human oversight should be treated as one control within a larger framework. For higher-impact communications, institutions should also define what the reviewer must check, what information is available to them, what authority they have to stop or correct the output, and how approval is recorded.

Which AI customer communications are highest risk?

Communications generally become higher risk when they can materially affect a customer's financial position, rights, access to services, obligations, or ability to understand an important decision.

Examples can include credit explanations, collections communications, fraud restrictions, claims decisions, eligibility notices, material account changes, regulated disclosures, and communications based on automated profiling. Exact legal classifications vary by jurisdiction. Peru's official AI classification, for example, identifies AI used for credit evaluation as high risk, except when it is used for financial-fraud detection.

How does AI governance interact with data privacy in Latin America?

AI governance and privacy governance overlap whenever AI processes personal data. Financial institutions should map the permitted purpose or legal basis, data minimization, security, transparency, retention, and data-subject rights for each jurisdiction in which the use case operates.

Article 20 of Brazil's LGPD addresses certain decisions made solely through automated processing that affect a person's interests. Mexico's private-sector data-protection law includes a right to object to certain automated processing that creates unwanted legal effects or significantly affects interests, rights, or freedoms. Colombia's data-protection authority has also issued specific guidance concerning personal-data processing in AI systems.

Must a bank tell customers when AI generated a communication?

Not universally. Whether disclosure is required depends on the jurisdiction, type of AI use, customer impact, applicable privacy or financial rules, and the circumstances of the interaction.

Institutions should therefore avoid creating a single global disclosure rule without legal review. Transparency can still be adopted as a governance principle even where a particular jurisdiction does not impose a blanket requirement to label every AI-assisted message.

What should be kept in an AI communication audit trail?

A defensible record should normally make it possible to identify the use case, relevant model or workflow version, approved sources, communication template, applicable policy, approvals or exceptions, final customer-visible output, delivery information, and subsequent incidents or disputes.

The amount of information retained should remain proportionate to the use case and applicable privacy and retention requirements. Auditability is strongest when evidence is designed into the workflow rather than reconstructed after a complaint or regulatory inquiry.

How does accessibility relate to AI governance?

Accessibility determines whether the final communication can actually be used by the intended customer, so it belongs inside the governance process. AI-assisted generation should preserve semantic structure, logical reading order, accessible tables, appropriate alternative descriptions, and other requirements relevant to the final format.

For PDFs, PDF/UA refers to the ISO 14289 family of standards for accessible PDF, while WCAG 2.2 is a W3C Recommendation for accessible web content. Financial institutions should determine which standards and legal requirements apply to each document, digital service, market, and delivery channel.