NIST AI RMF, GovernGOVERN 2.1

Senior management should develop and operationalize enterprise-wide model risk management policies, and each model in use should have an owner who is clearly assigned and who keeps thorough documentation at each stage of the model's life cycle.

Establish and monitor your trading systems and trading algorithms through a clear and formalized governance arrangement that sets out clear lines of accountability, including procedures to approve the development, deployment and subsequent updates of trading algorithms and to solve problems identified when monitoring them, effective procedures for the communication of information within the firm, and a separation of tasks and responsibilities of trading desks on the one hand and supporting functions, including risk control and compliance, on the other (Delegated Regulation (EU) 2017/589, Article 1).

Where you provide investment advice or portfolio management services in whole or in part through an automated or semi-automated system, keep the responsibility to undertake the suitability assessment with yourself as the investment firm providing the service; the use of an electronic system in making the personal recommendation or decision to trade does not reduce it (Delegated Regulation (EU) 2017/565, Article 54(1)).

The CBJ expects you to establish an AI oversight committee or clearly delegate AI governance responsibilities to an existing governance body, to have the use of AI in decision-making approved by an appropriate internal authority, to stay accountable for internally developed and externally sourced AI-driven decisions, and to designate an AI System Owner for each AI system (sections 1.1 and 2.4).

The Commission advises you to include human oversight in critical decision-making processes and to define clearly who is responsible for an AI system across its entire life cycle, without changing the supervisory expectations that already apply to your governance.

The Commission advises you to establish procedures for monitoring AI systems and clear accountability for AI-related errors or malfunctions, and to run ongoing monitoring and evaluation of the ethical and societal impact of your AI systems.

If you provide investment advice or portfolio management services in whole or in part through an automated or semi-automated system, remain responsible for the suitability assessment required by COBS 9A.2; that obligation is not affected by the use of an electronic system in making the personal recommendation or decision to trade (COBS 9A.2.23R).

Set clear policies and roles and responsibilities for model development, validation and monitoring, including how conflicts of interest are handled. Where internal audit is part of the practice, its role is generally to evaluate whether model risk management practices are rigorous and effective rather than to duplicate development or validation.

Share each report and update with your officers and directors at least quarterly, withholding it from any officer or director the report accuses of wrongdoing.

Apply PIPEDA's purpose-limitation and accountability obligations to personal information collected by crawling, the same as personal information collected any other way.