NIST AI RMF, GovernGOVERN 2.3

Senior management should develop and operationalize enterprise-wide model risk management policies, and each model in use should have an owner who is clearly assigned and who keeps thorough documentation at each stage of the model's life cycle.

When using technology-enabled innovation for credit-granting purposes, institutions should capture the inherent risks in their risk management and control frameworks, commensurate with the business model, credit risk exposure, complexity of the methods and extent of use, and ensure that the management body sufficiently understands its use, limitations and impact on credit-granting procedures (paragraph 53(a) and (b)).

Your AIS Program should vest responsibility for its development, implementation, monitoring, and oversight, and for your strategy for AI Systems, with senior management accountable to the board or an appropriate committee of the board (guideline 1.3).

You cannot outsource your fundamental risk management responsibility, even when a third party performs a service, and you should have clear policies and expectations for use of AI Systems, including permissible use by employees (guideline 1.10).

It reaches you if you are a licensed financial institution in the UAE, including an insurance provider (an LFI in the Guidance Note), that uses AI systems or ML technologies. The Guidance Note sets out the Central Bank's expectations and no rule of its own, so each line below states what the Central Bank says LFIs should do: adopt a documented governance framework for AI and ML that is commensurate with the size, nature and complexity of your operations, with the Board and senior management responsible and accountable for AI and ML systems and outcomes, and do not employ AI models you have no control over (Sections 2(a) and 2(b)).

Establish a Model Oversight Committee accountable for all significant modelling decisions at each step of the model life-cycle, with the Board bearing responsibility for modelling decisions with material implications and defining your appetite for Model Risk (Sections 3.1.6 and 3.1.8(i)).

Take responsibility for all modelling decisions, model outputs and related financial consequences, even if third parties are involved (Section 3.1.10).

The FCA says any use of AI in relation to an activity, business area or management function of a firm falls within the responsibilities of a Senior Management Function manager (paragraph 3.40).

Have the board approve the model risk management policy, set a model risk appetite and receive regular reports on the firm's model risk profile against it, allocate responsibility for the framework to the relevant Senior Management Function holder or holders and reflect it in their Statements of Responsibilities, document roles and responsibilities for each stage of the model lifecycle, and, for third-party vendor models, satisfy yourself that they have been validated to the same standards as your own and validate your own use of them (Principle 2).

Develop, publish and follow a Model Safety Plan for each AI system or model you create, substantially modify, or use in the training or evaluation of other AI models, naming the model or system, a capabilities or risk assessment, the mitigation measures for each assessed item across the product lifecycle, and the corporate officer responsible for carrying it out

Take responsibility for the content your AI information system generates.