Open Source in Finance Forum London 2026

Financial institutions depend on open source software — and are rapidly adopting open source AI to bring new capabilities to their clients. Yet most companies still treat patents and open source in a siloed manner with separate strategic approaches, managed by different teams with no collaborative framework. The result: patent risk across open source dependencies may be missed, and valuable contribution opportunities may be lost to IP policies lacking high context of the technology.

This session makes the case for a unified strategy; we'll explore where patents and open source collide in practice — from traditional software licensing tensions to the emerging threat of patent aggression targeting AI frameworks. We'll also examine how the Open Invention Network's (OIN) 2.0 program is evolving defensive patent structures to meet these challenges, now covering 650+ packages spanning cloud, security, and the AI tooling at the heart of modern financial infrastructure.

Attendees will leave with a practical framework to reduce patent exposure, contribute confidently to open source communities, and turn a persistent source of internal friction into competitive advantage.

Modern software factories generate change at machine pace, but the why behind every change disappears into commit messages written after the fact. This talk introduces a provenance-first approach to version control where intent, attestations, and semantic lineage are first-class primitives, grounded in SLSA provenance frameworks to ensure interoperability with emerging supply chain security standards. We demonstrate how structured problem statements derived from natural language prompts are attached to every change, traceable through an immutable attestation chain, and queryable without a round-trip to an LLM. Attendees will see a live demo of Atomic's inner loop, where a vibe coding prompt is formalized into a structured intent object, enriched with AST and tree-sitter data, and sealed with SLSA-compliant provenance metadata before it ever touches shared infrastructure. Every gate verdict, agent dispatch, and integration decision is recorded in a decision ledger, an immutable record of not just what changed, but what was decided and why at every step of the software factory. We close with a discussion of what provenance-aware version control makes possible that Git fundamentally cannot: retroactive auditability of agent-generated code at scale, without instrumentation after the fact.

• CALM
• CCC
• Fluxnova

The FINOS AI Governance Framework identifies non-deterministic behavior as a core operational risk—but stops short of prescribing how to fix it. Two research papers offer contradictory answers: one says temperature zero is enough, the other says you need specialized GPU kernels. Both can't be right—and for workflows governed by SR 11-7, the answer determines whether LLMs can be deployed at all.

This talk follows our 16,000-call reproduction study across consumer and enterprise GPUs to resolve these claims. Starting with a 2025 study claiming small models achieve perfect determinism, we found their results didn't replicate. Moving to H100s with vLLM gave different answers—until we toggled a single infrastructure setting.

We present our findings as a reference architecture for deterministic LLM inference, mapped to the AIGF's risk taxonomy. Using Basel III Pillar 3 document extraction as our test case, we show which infrastructure choices—batch-invariant kernels, inference engine configuration, hardware selection—mitigate the non-determinism risk the AIGF catalogs but doesn't yet solve.

Financial institutions are pursuing ambitious AI value targets, and the FINOS AI Governance Framework offers an expert‑curated structure to help achieve them responsibly. With operational infrastructure, Trustworthy AI becomes a practical accelerator.

This session presents an open DevSecOps‑ready reference implementation of operational AI governance, with live demo.

See AI governance in action via four access patterns: CLI (automation), REST API (integration), Web UI (exploration), and Graph DB (analysis). Watch automated discovery, mitigation mapping, and cross‑referencing. Adaptable “Start Left” patterns you can adapt (including a lightweight bioscience CSR).

You’ll also hear about the “Linked Data Model Operate” (LinkMO) pattern: Open Data standards data models, making datasets (e.g., NIST, ISO, GRC, MIT, MITRE, OWASP, etc) AI-ready, and driving KG-enabled security and compliance automation.

Every board is asking some version of: “Are we safer or riskier with AI in engineering?” The answer depends on governance. This talk introduces a simple executive framework for AI use in development — one that preserves velocity while reducing risk from insecure patterns, license surprises, data leakage, and unreviewed changes moving faster than human oversight. We’ll explain why AI increases variance in code quality and why traditional controls (manual review, ticket-based approvals) don’t scale. Then we’ll outline guardrails that do: policy-as-code for what can ship, automated verification for what’s been pulled in, and clear accountability for “human-in-the-loop” decisions. Importantly, we’ll position AI as a force multiplier for both attackers and defenders — and show how mature financial services organizations respond: they don’t ban AI; they create measurable, enforceable standards for trust. The outcome: faster delivery with fewer surprises in production and compliance.

Most architecture reviews happen after the code is already written, too late to prevent drift. In regulated industries, governance lives in documents and review boards instead of the pull-request workflow where change actually happens.
This talk shows how CALM can serve as the architectural source of truth for PR-time compliance checks, pairing deterministic structural validation with contextual AI explanations.
I'll walk through an approach where approved architecture definitions are parsed from CALM, normalized into a graph, and used during code review to detect undeclared dependencies, bypassed boundaries, or unexpected interaction patterns, creating an auditable, scalable control point without slowing delivery.

The session covers the practical design of the validator, how deterministic checks and AI explanations complement each other, and why this model is especially relevant for financial services teams that need both control and evidence. Attendees leave with a pattern for using open standards and open source tooling to move architecture governance closer to the software delivery lifecycle.