3 Questions Bank Clients Ask That Stall AI Projects
Three questions from bank clients that hold up AI projects: data location, sub-processors, and incident accountability. Here is the regulatory basis behind each, and what SIs should prepare.
AI projects at banks rarely die because the model is not accurate enough. They stall when the system integrator cannot answer three questions with written evidence: where the data is processed, who the sub-processors are, and who is accountable when an incident happens.
None of these questions come down to procurement team preferences. Each one is rooted in the regulations in force for Indonesian banks as of October 2026, so an SI that prepares the answers before the proposal moves faster than one that only starts looking for them after the user acceptance test.
What questions stall AI projects at banks the most?
The three questions trace back to three different sources: POJK 11/POJK.03/2022 on information technology at commercial banks, PP 33/2026 as the implementing regulation for the PDP Law, and OJK's AI Governance Guidelines for the Indonesian Banking Sector. The table below maps each question to its regulatory basis and to the evidence an SI should have ready before the technical presentation.
| Bank client question | Regulatory basis | What the SI should prepare |
|---|---|---|
| 1. Where is our data processed, including during inference and logging? | POJK 11/POJK.03/2022: a bank's electronic systems, including data centers and disaster recovery centers, are placed in Indonesia by default; placement abroad is only for specific criteria and requires OJK permission. PP 33/2026: transferring personal data abroad requires mapping, an assessment of the legal instrument, and a risk assessment. | A data flow diagram per component (OCR, embedding, LLM, vector database, logs), the physical location of each component, and a written statement that no API call leaves Indonesia. |
| 2. Who are the sub-processors, and what binds them? | PP 33/2026: a processor may only involve another processor with the controller's written consent; the written agreement covers scope, purpose, duration, and audit mechanism. | A sub-processor list (GPU provider, model provider, observability), each one's legal entity and country, their security certifications, and audit-rights clauses. |
| 3. If the model is wrong or an incident occurs, who explains it and who reports it? | OJK's banking AI governance guideline (launched 29 April 2025): AI systems must be safe, fair, and explainable, managed across their full lifecycle. PP 33/2026: the controller notifies data subjects and the Agency within 3 x 24 hours; the processor reports to the controller as soon as possible. | An incident accountability matrix (bank, SI, infrastructure provider), auditable inference logs, an escalation path with named owners, and a way to explain model outputs to the bank's AI committee. |
Timing note: PP 33/2026 was set on 16 July 2026 and takes effect on 16 January 2027. Projects signed this quarter will run under it. The full breakdown is in PP 33/2026: What It Means for AI Projects, and the per-activity division of responsibilities is in who holds what between SIs and infrastructure providers.
Where IONext fits
IONext covers the infrastructure half of questions 1 and 2. GPU, managed inference, and open-weight model hosting on IONext run in Jakarta, operated by PT Data Awan Nusantara as an Indonesian legal entity, certified to ISO/IEC 27001:2022 by TÜV NORD (certificate no. 01 07 E 26000410), with billing in Indonesian Rupiah. The details an SI can attach to a tender document are on the IONext Security and Compliance page.
The limits are clear. IONext does not replace the bank's DPIA, does not handle OJK permissions, and does not own the explanation of application logic the SI builds. For question 3, IONext provides the infrastructure and observability layer through IONA, while the accountability matrix is still built jointly by the bank, the SI, and IONext.
SIs preparing an AI proposal for a bank can start through the IONext Partner Program. To try the workspace and observability first, sign up free on the IONext console.
Sources
- POJK No. 11/POJK.03/2022 on Information Technology at Commercial Banks, Articles 35 and 36: Bisnis.com summary, OJK FAQ
- OJK, AI Governance Guidelines for the Indonesian Banking Sector (29 April 2025); ANTARA coverage
- PP No. 33 of 2026 implementing Law No. 27 of 2022 on Personal Data Protection: Veritask summary
This article is general information, not legal advice. Confirm project-specific obligations with the client's legal and compliance team.