Why financial service providers need an AI systems program

What this means for financial service providers

The bulletin’s regulatory guidance states that compliance with the standards is required regardless of the tools used to make decisions. It notes that, without proper controls, AI may increase the risk of inaccurate, arbitrary or discriminatory outcomes, making it critical to implement controls that mitigate adverse consumer outcomes.

The bulletin further states: “All financial service providers are expected to develop, implement and maintain a written AI Systems Program (AIS Program) for the responsible use of AI systems.” Organizations not formally using AI should, at a minimum, establish policies governing employee use.

The bulletin outlines four key pillars: general guidelines, governance, risk management and internal controls and third-party AI systems and data. These pillars provide an overview of how institutions can develop and test an AIS program:

General guidelines

• Design the AIS program to mitigate risks of adverse consumer outcomes, addressing governance, risk management controls, and internal audit functions.
• Hold senior management accountable to the board or relevant committee for AIS program oversight
• Tailor controls and procedures to the organization’s use of AI systems.
• Align the AIS program, where possible, with recognized frameworks such as the NIST AI Risk Management Framework.
• Address AI use across all business lines and lifecycle phases, including third-party systems.
• Establish processes to notify consumers of AI use and provide appropriate transparency.
• Maintain clear policies for employee use and retain responsibility for risk management, including outsourced activities.

Governance

• Establish a governance framework covering policies, procedures, risk management and controls across the AI lifecycle.
• Document AIS program standards and requirements for consistency and compliance.
• Define accountability structures, including committees, escalation protocols and training responsibilities.
• Document predictive model practices across design, development and monitoring, including error detection and bias mitigation.

Risk management and internal controls

• Implement oversight and approval processes for AI system development, adoption and acquisition
• Establish data governance practices, including security, testing, quality and bias analysis.
• Maintain model inventories and documentation, including purpose, development, validation and performance monitoring.
• Conduct validation testing and ongoing reassessment of data and models.
• Protect nonpublic consumer information from unauthorized access.
• Maintain appropriate data and record retention practices.

Third-party AI systems and data

• Conduct due diligence to ensure third parties meet regulatory requirements.
• Include contractual provisions for audit rights and regulatory cooperation.
• Require prompt notification of unauthorized access events.
• Define responsibilities for data protection and risk mitigation.

Responsible AI governance is key to examination preparation

Financial service providers should be prepared to produce a written AIS program and supporting documentation during examinations. However, documentation alone is not sufficient. The bulletin states that examiners may request detailed information on specific models, AI systems, and their applications. Organizations should treat their AIS program as a structured framework that connects policies, procedures, and operational practices across the enterprise.

How to strengthen your AI governance and compliance