Five risks come up repeatedly. First, payment data is often spread across legacy systems, making it difficult to access, combine, and use in the right format. Fraud models also become less effective over time as attackers adapt their behaviour.

Overly aggressive controls can reject legitimate customers and create more losses through false declines than they prevent through fraud. Using hosted AI models can also expand the PCI compliance boundary and introduce third-party dependencies that need to be managed under DORA.

Finally, AI requires ongoing monitoring, retraining, testing, and audit support. These operational costs continue long after the initial model is deployed.