NIST AI RMF, GovernGOVERN 1.4

OSFI expects a sound governance framework for model risk, with policies and procedures that cover each stage of a model's life cycle (development, validation, approval, review, modification and decommission) and that name the stakeholders and their roles, responsibilities and authorities.

OSFI expects you to have a model risk management framework that fits your broader risk and governance framework, reflects your risk appetite for model risk, defines how model risk is identified, assessed, managed, monitored and reported, covers models or data sourced from third-party vendors (pursuant to Guideline B-10), and is reviewed periodically, especially as new technologies emerge.

Establish a documented, risk-based governance and risk management framework, including a cross-functional governance group drawing on legal, compliance, risk management, product development, underwriting, actuarial, data science, marketing, and customer service, designed to determine through quantitative testing whether your use of an external consumer data and information source, or an algorithm or predictive model that uses one, results in unfair discrimination with respect to race, and to remediate any discrimination detected.

Institutions should specify the use of any automated models in the creditworthiness assessment and credit decision-making processes in a way that is appropriate to the size, nature and complexity of the credit facility and the types of borrowers, and set out appropriate governance arrangements for the design and use of such models and the management of the associated model risk (paragraph 41).

When using technology-enabled innovation for credit-granting purposes, institutions should capture the inherent risks in their risk management and control frameworks, commensurate with the business model, credit risk exposure, complexity of the methods and extent of use, and ensure that the management body sufficiently understands its use, limitations and impact on credit-granting procedures (paragraph 53(a) and (b)).

The Department expects you to develop, implement, and maintain a written AI Systems Program (an AIS Program) for the responsible use of AI Systems that make or support decisions related to regulated Financial Service Provider practices, designed to mitigate the risk of Adverse Consumer Outcomes.

If you choose not to formally engage in the use of AI Systems, you should, at a minimum, establish a policy for employee acceptable use of such AI systems.

It reaches you if you are a licensed financial institution in the UAE, including an insurance provider (an LFI in the Guidance Note), that uses AI systems or ML technologies. The Guidance Note sets out the Central Bank's expectations and no rule of its own, so each line below states what the Central Bank says LFIs should do: adopt a documented governance framework for AI and ML that is commensurate with the size, nature and complexity of your operations, with the Board and senior management responsible and accountable for AI and ML systems and outcomes, and do not employ AI models you have no control over (Sections 2(a) and 2(b)).

It reaches you if you are a bank licensed by the Central Bank of the UAE, including an Islamic bank and a UAE branch or subsidiary of a foreign bank, and you employ models to support decision-making, a scope that the Standards say covers all types of models and lists in Table 1 with Artificial Intelligence among the commonly employed model types (Sections 2.1 and 2.4): define a comprehensive model management framework that covers all models used to make decisions, and incorporate Model Risk in your risk framework so that it is identified, measured, monitored, reported and mitigated through a formal process (Sections 3.1.2 and 3.1.3).

Keep documentation adequate to support effective model risk management, including the tracking of recommendations, responses and exceptions.

If you are the provider of a high-risk AI system, put in place a quality management system that ensures compliance with the Regulation, documented in a systematic and orderly manner as written policies, procedures and instructions.

Cover at least: a regulatory compliance strategy, including conformity assessment and the management of modifications; design, design control and design verification; development, quality control and quality assurance; examination, test and validation procedures before, during and after development, and how often they run; the technical specifications and standards you apply; data management; the Article 9 risk management system; a post-market monitoring system under Article 72; procedures for reporting serious incidents under Article 73; communication with authorities, notified bodies, other operators, customers and other interested parties; record-keeping of all relevant documentation and information; resource management, including security of supply; and an accountability framework for management and other staff.

Have a quality management system in place that complies with Article 17, and keep the documentation referred to in Article 18.

If you are the provider of a high-risk AI system, establish, implement, document, and maintain a risk management system for it, run as a continuous process across its whole lifecycle with regular review and updates.

An owner of such a heightened-risk system must meet the Cabinet of Ministers' risk-management, transparency, accuracy, reliability, data-quality and technical-documentation requirements, keep operating logs, and declare conformity in a signed digital document published on the owner's site before the system is deployed.

If a deployer of a critical artificial intelligence system controls, in whole or in part, a critical infrastructure facility, develop a risk management policy after deploying the system

The policy must be reasonable and consider a nationally or internationally recognized AI risk management framework, such as the NIST AI risk management framework

If you provide high-impact AI, or a product or service that uses it, establish and operate a risk-management plan for it.

If you are a large frontier developer (a frontier developer whose group had annual gross revenues over $500,000,000 in the prior calendar year), write, implement and publish on your website a frontier AI framework describing how you define and assess catastrophic-risk thresholds for your frontier models and apply mitigations, and review that framework at least once a year

If you are a large frontier developer, from 1 January 2028 write, implement, comply with and publish on your website a frontier AI framework covering catastrophic-risk assessment, mitigations, cybersecurity, internal governance, third-party evaluations, and risks from your own internal use of your frontier models.

If you are a large frontier developer (a person that has trained a foundation model using more than 10^26 operations and, with its affiliates, has annual gross revenues above $500,000,000), write, implement, comply with, and publish a frontier AI framework describing how you assess and mitigate catastrophic risk, and review it at least annually.

From January 1, 2027, if you are a large frontier developer (a frontier developer whose annual gross revenues, together with its affiliates, exceeded $500 million in the preceding calendar year), write, implement, comply with and conspicuously publish on your website a frontier AI framework describing how you set capability thresholds for catastrophic risk, apply and review mitigations before deploying a frontier model or using it extensively internally, use third-party assessors, secure unreleased model weights, respond to critical safety incidents, govern these processes internally, and manage catastrophic risk from internal use.

If you develop a sovereign or national large foundation AI model, take organizational and technical measures to secure it, define operating rules covering restrictions, conditions of use, updates, and decommissioning, and maintain technical documentation of its key parameters and limitations sufficient to assess the safety of its application.