JM-98-2025: the region's first regulation to name artificial intelligence
The Technology Risk Management Regulation applies to banks, financial companies and financial-group entities supervised by the SIB. Its Article 22 gives an article number to the question of the moment.
JM-98-2025 · Article 22 · Artificial intelligence systemsRequires governance of AI systems with “human supervision over the decisions made by these systems.”
The clock: manuals and contracts adapted by October 30, 2026; criticality analysis of all contracted services by January 31, 2027. Adaptation is running now.
What the regulation demands of software development
- Art. 27. Security controls for the acquisition, development and maintenance of systems and applications.
- Art. 26. Changes and exceptions with registration and follow-up.
- Art. 17. Documented methodologies for development, testing, version control and quality.
- Art. 18. Vulnerability detection with results recorded in a technical report.
How LineBreak answers
- Nothing reaches production with known vulnerabilities. Every change is scanned before merging; if the scanner cannot run, the change does not pass. Exceptions are human, scoped to one exact finding, with name and reason on the record.
- The AI writes the code; an identified person signs. Approved criteria carry the name of who approved them. The AI writing code can read them, but cannot modify them.
- Every approval is cryptographically signed. Your auditor verifies it independently, without relying on us or on the team's word, years later if needed.
- The evidence lives in YOUR infrastructure. Not on our servers. The record of every change (who approved what, when, with what result) travels with the code itself.
What LineBreak is NOT
- LineBreak does not certify or guarantee compliance with any regulation: it produces the evidence your accountable people answer with.
- It does not replace the roles your regulation requires (security officers, internal audit, regulatory reporting).
- Decisions and accountability remain human. That is the product's design principle.
An AI-generated change is blocked, a person approves it by name, and the audit report is generated in front of you. With your risk team or your auditor present.