Financial Services AI Governance

Key Provisions

• - Annex III Section 5(b): AI systems evaluating creditworthiness or establishing credit scores are high-risk
• - Annex III Section 5(a): AI systems determining access to essential financial services (insurance, banking) are high-risk
• - Mandatory risk management system (Article 9) with continuous monitoring
• - Data governance requirements (Article 10) for training datasets including bias assessment
• - Technical documentation (Article 11) and record-keeping (Article 12) requirements
• - Transparency obligations (Article 13) — users must understand AI output
• - Human oversight mechanisms (Article 14) for credit and insurance decisions
• - Accuracy, robustness, and cybersecurity requirements (Article 15)

Impacted AI Types

• - Credit scoring and creditworthiness assessment
• - Insurance risk pricing and underwriting
• - Fraud detection and anti-money laundering
• - Customer risk profiling
• - Automated lending decisions

Compliance Actions

• - Map all AI systems against Annex III high-risk categories
• - Implement Article 9 risk management system for each high-risk AI
• - Conduct Article 10 data governance assessments for training datasets
• - Create technical documentation packages per Article 11
• - Design human oversight mechanisms per Article 14
• - Register high-risk AI systems in EU database per Article 49

Key Provisions

• - ICT risk management framework (Chapter II) applies to all AI systems in financial operations
• - ICT incident classification and reporting (Chapter III) — AI system failures are reportable incidents
• - Digital operational resilience testing (Chapter IV) — AI systems must undergo threat-led penetration testing
• - Third-party ICT risk management (Chapter V) — AI vendor concentration risk assessment required
• - Critical ICT third-party provider oversight (Chapter V, Section II) — cloud AI providers may be designated critical
• - Information sharing (Chapter VI) — intelligence sharing on AI-related threats

Impacted AI Types

• - All AI systems in financial institution operations
• - Cloud-hosted AI inference services
• - Third-party AI models and APIs
• - AI-powered trading systems
• - Customer-facing AI services

Compliance Actions

• - Include AI systems in ICT risk management framework
• - Classify AI system failures in incident reporting taxonomy
• - Include AI systems in operational resilience testing program
• - Assess AI vendor concentration risk across critical functions
• - Establish AI system recovery time objectives and procedures
• - Implement AI-specific threat intelligence monitoring

Key Provisions

• - Enforcement against misleading AI claims in public disclosures and marketing materials
• - Fiduciary duty extends to AI-driven investment advice and portfolio management
• - Proposed Rule: Conflicts of Interest Associated with the Use of Predictive Data Analytics
• - Examination priorities include AI use in trading, compliance, and customer interactions
• - AI model governance expectations for registered investment advisers
• - Recordkeeping requirements for AI-assisted investment decisions

Impacted AI Types

• - AI-driven investment advice and robo-advisors
• - Algorithmic and AI-powered trading systems
• - AI in compliance monitoring and surveillance
• - Customer-facing AI interactions (chatbots, recommendations)
• - AI in public company financial disclosures

Compliance Actions

• - Review all public AI claims for accuracy and substantiation
• - Document AI model governance for investment decision systems
• - Implement conflict-of-interest assessment for predictive analytics
• - Establish recordkeeping protocols for AI-assisted decisions
• - Include AI governance in SEC examination readiness program
• - Train compliance teams on AI-specific regulatory expectations

Key Provisions

• - AI/ML models used for regulatory capital calculations subject to enhanced validation
• - Model risk management expectations aligned with SR 11-7 principles
• - Explainability requirements for AI models used in supervisory reporting
• - Data quality standards for AI training data used in risk models
• - Governance expectations including AI-specific model inventory and tiering
• - Stress testing requirements for AI model robustness

Impacted AI Types

• - Credit risk AI models (PD, LGD, EAD)
• - Market risk AI models
• - Operational risk AI analytics
• - Stress testing AI models
• - Regulatory reporting AI systems

Compliance Actions

• - Tier AI models by materiality and regulatory impact
• - Apply enhanced validation for AI models in capital calculations
• - Document explainability analysis for supervisory AI models
• - Establish AI-specific stress testing scenarios
• - Align AI model governance with Basel Pillar 2 expectations

Key Provisions

• - Consumer Duty applies to AI-driven product recommendations and pricing
• - AI must not create unfair outcomes for vulnerable customers
• - Market integrity expectations for AI trading systems
• - Senior Management Functions (SMF) accountability for AI outcomes
• - AI model governance expectations aligned with SS1/23 (model risk management)
• - Third-party AI model oversight expectations

Impacted AI Types

• - AI in customer product recommendations
• - AI pricing and personalization engines
• - Algorithmic trading systems
• - AI in claims handling and underwriting
• - AI-powered financial advice

Compliance Actions

• - Map Consumer Duty requirements to AI-driven customer interactions
• - Assess AI pricing models for vulnerable customer impact
• - Designate SMF accountable for AI governance outcomes
• - Implement SS1/23 model risk management for AI models
• - Conduct third-party AI model due diligence

Key Provisions

• - AI systems processing cardholder data are in scope for PCI-DSS assessment
• - AI fraud detection systems must comply with data storage and encryption requirements
• - AI model training on transaction data requires data minimization controls
• - Customized approach allows AI-driven security controls if meeting control objectives
• - Third-party AI payment processors require Level 1 service provider assessment
• - AI system access controls must meet PCI-DSS strong authentication requirements

Impacted AI Types

• - AI fraud detection in payment processing
• - AI transaction monitoring and risk scoring
• - AI-powered payment authorization
• - Chatbots handling payment information
• - AI in chargeback and dispute resolution

Compliance Actions

• - Include AI systems in PCI-DSS scope assessment
• - Verify AI training data does not retain prohibited cardholder data elements
• - Validate AI fraud detection complies with encryption at rest and in transit
• - Assess AI vendors as service providers under PCI-DSS
• - Document AI system access controls in PCI-DSS evidence package

Key Provisions

• - All AI/ML models must be included in the model inventory and risk-tiered
• - Model validation must address AI-specific risks (opacity, instability, data dependence)
• - Three lines of defense: model development, validation, and audit
• - Ongoing monitoring requirements including performance, stability, and conceptual soundness
• - Model risk appetite and limits must account for AI-specific uncertainty
• - Board and senior management oversight of material AI model risks

Impacted AI Types

• - All AI/ML models used in banking operations
• - Credit decision models
• - Fraud and AML models
• - Market risk and pricing models
• - Operational risk models
• - Regulatory capital models

Compliance Actions

• - Include all AI/ML models in enterprise model inventory
• - Apply risk tiering to AI models based on materiality and complexity
• - Establish independent model validation for AI systems
• - Implement AI-specific monitoring for drift, stability, and performance
• - Document explainability analysis for each AI model
• - Report material AI model risks to board risk committee