NIST AI RMF, GovernGOVERN 1.6

Maintain an up-to-date inventory of all models in use and recently decommissioned, controlled by a list of authorized individuals, and make it available to OSFI on request.

A standardized institution should, at a minimum, provide OSFI with an inventory of all models in use and identify and assess its most material models.

You should identify and track all models in use or recently decommissioned, including vendor and third-party models, and keep every model with non-negligible inherent model risk in a model inventory that is comprehensive, maintained at the enterprise level, accurate and updated in a timely manner.

At a minimum, maintain for each identified model its ID, name and description of key features and use, model risk rating, owner, developer and origin, and for each model in the inventory also its version, deployment date, reviewer, approver, dependencies, data sources, approved uses, limitations, most recent review date, monitoring status and next review date.

Keep, in addition to the records required by section 29 of the Financial Services Act, a copy of the advice given and the output of the investment, the client information relied on to generate the advice, and details of all algorithms and software you use (clause 12).

Your AIS Program should document your risk identification, mitigation, and management framework and internal controls, including inventories and descriptions of Predictive Models, validation, testing, and retesting, protection of non-public information, and data and record retention (guidelines 3.1 to 3.7).

A QCB-regulated entity deploying a High-Risk AI system must maintain an AI system register, adopt an AI governance policy, conduct risk and bias assessments, and provide human oversight of the system's decisions.

Maintain an inventory of all AI models, systems or technologies you develop or deploy, with at least the model name, purpose and risk rating, following the Central Bank's Model Management Standards and Model Management Guidance (2022) (Section 2(f)).

Adopt the statement's definition of a model as the scope of your model risk management framework, keep a complete and accurate firm-wide inventory of models in use, under development and decommissioned, and assign each model a risk-based tier by materiality and complexity, considering where necessary alternative and unstructured data and the model's interpretability, explainability, transparency and potential for designer or data bias (Principle 1).

Maintain a model inventory with enough information to understand model risks at the individual and aggregate levels; the guidance calls this common industry practice.