A regulated bank just put AI in front of 100,000 employees. Your "we're too compliance-bound" line is gone.

“We’re too regulated” is no longer an argument. It’s an excuse.

On June 11, OpenAI published that BBVA scaled ChatGPT Enterprise to 100,000 employees. BBVA is a retail bank that is globally supervised, audited, and bound by data rules stricter than yours.

So the line your compliance lead keeps using just lost its best example.

The veto comes from you, not the regulator

The veto against AI in regulated work almost never comes from the regulator. It comes from your own unwritten assumptions about what the regulator would say. Nobody asked. Nobody wrote the precondition down. The workflow died in a hallway, not in a hearing.

I’ve watched this from inside a CJIS-regulated deployment, the kind that handles criminal justice data with real penalties for getting it wrong. The rulebook wasn’t the wall. The wall was a set of beliefs nobody had tested against the actual rule.

The bank tested it. You haven’t.

That’s the whole gap.

What the objection is really protecting

Now notice what the objection is really doing: it’s protecting you from a decision. As long as “too regulated” stands, no one has to name a workflow, write a control, or own a pilot. The excuse is comfortable because it’s unfalsifiable. BBVA just falsified it.

A more regulated operator shipped first. The objection has nowhere left to stand.

The Monday move

Name one workflow you’ve personally blocked on data-sensitivity grounds. The contract review you wouldn’t let touch the model. The case summaries you kept off-platform. The customer notes you quarantined.

Then write the single sentence that would have to be true for a 30-day pilot to start. Not ten conditions. One. “We can run this if the data never leaves our tenant.” “We can run this if every output is logged and human-reviewed.” Whatever it is, write it as one testable claim.

That sentence is the entire game. Either it’s true and you’ve been blocking nothing, or it’s false and now you know the one control to build.

Most “we can’t” is “we never checked.”

A bank with 100,000 employees and a banking license checked. Your version is smaller and the stakes are lower.