新加坡《人工智能风险管理指引》

MonetaryAuthorityofSingapore

Guidelines7October2026

GuidelinesonArtificialIntelligenceRisk

Management

7OCTOBER2026|2

GuidelinesonArtificialIntelligenceRiskManagement

Contents

1.Introduction3

2.ApplicationoftheGuidelines8

3.AIOversight10

4.KeyAIRiskManagementSystems,PoliciesandProcedures13

5.AILifeCycleControls17

6.AICapability&Capacity30

7OCTOBER2026|3

1.Introduction

1.1.TheGuidelinesonArtificialIntelligence(Al)RiskManagement(the“Guidelines")setoutMAS'supervisoryexpectationsrelatingtoAlriskmanagementinfinancialinstitutions(Fls)²,andseektosupporttheirresponsibleadoptionofAI.TheseGuidelinessetoutMAS'supervisoryexpectationsintheareasofoversight,keyAlriskmanagementsystems,policies,procedures,Allifecyclecontrols,andcapabilitiesandcapacityfortheuseofAI.AnoverviewofthekeysectionscoveredintheseGuidelinesissetoutbelow.

1.Introduction

AIUseCases,Systems&Models

2.ApplicationoftheGuidelines

AllFls;Risk-proportionateApplication

3.AIOversight

BSMRoles&Responsibilities;Org.WideOversightandCoordination

4.KeyAlRiskManagementSystems,Policies&Procedures

AlIdentificationAIRiskMaterialityAssessmentAlInventory

5.AILifeCycleControls

·HumanOversight·DataManagement·Reviews&Monitoring

·Third-PartyAl·Tech.&Cybersecurity·ChangeManagementTransparency&Explainability·Selection·Reproducibility&Auditability

6.AICapability&CapacityAICapabilitiesAITech.Infra.

Figure1:OverviewoftheGuidelines

1.2.TheGuidelinescomplementexistinglegislationandguidelinesissuedbytheMAS.Theyshouldbereadinconjunctionwithrelevantguidelines,informationpapersandcircularsthatMASmayissuefromtimetotime.Forinstance,existingprinciplesonFairness,Ethics,AccountabilityandTransparency(FEAT)²continuetoapplyforguidingtheuseofAlinthefinancialsector.Flsshouldalsotakeintoaccountapplicableindustrystandardswhereappropriate³.TheGuidelinesapplyonagroupbasisforlocally

¹AsdefinedinSection2oftheFinancialServicesandMarketsAct2022.

2

.sg/publications/monographs-or-information-paper/2018/feat

3Flsmayalsorefertokeyinitiativesatthenationallevel,suchastheCyberSecurityAgencyofSingapore'sGuidelinesandCompanionGuideonSecuringAISystems,theInfocommMediaDevelopmentAuthority'sModel(IMDA)AIGovernanceFramework,aswellasthevariousinitiativesundertheAIVerifyFoundationtoinformtheiruseofAI.

GuidelinesonArtificialIntelligenceRiskManagement

7OCTOBER2026|4

GuidelinesonArtificialIntelligenceRiskManagement

incorporatedFIs,thatare(i)subjecttoconsolidatedsupervisionbyMA

S4

or(ii)anownerofacriticalinformationinfrastructur

e5.

1.3.ForthepurposeoftheseGuidelines,AIreferstomachine-basedsystemsormodelsthatderiveoutputsthroughlearnedpremisessuchasthedataorinputsitreceives.Theoutputscanincludeestimates,predictions,content,summaries,recommendations,ordecisionsthatmayinfluencephysicalorvirtualenvironments.DifferentAIvaryintheirlevelsofautonomyandadaptivenessafterdeploymen

t6.

CalculatorsortoolswhoseoutputsaresolelybasedonpredefinedprogramminglogicorruleswouldnotberegardedasAIforthepurposeoftheseGuidelines.

1.4.Inaddition,thefollowingdefinition

s7

areused:

(a)Amodelisamethodorapproachwhichconvertsassumptionsandinputdataintooutputssuchasestimates,decisions,orrecommendations.

(b)Asystemcomprisesoneormoremodelsandothermachine-basedcomponents.

(c)Ausecasereferstoaspecificreal-worldcontextthatthemodelorsystemisappliedto.

1.5.TheGuidelinesestablishasetofhigh-levelexpectationsthatallFIsshouldadheretoastheydeployAI,includingGenerativeAIandnewerdevelopmentssuchasAIagents.AnFIwhichispartofaglobalgroupmaytakeguidancefromorleveragetheirGroup’sAIriskmanagementframeworks,aslongasthoseframeworksmeettheexpectationssetoutintheseGuidelines.

1.6.FIsshouldimplementtheseGuidelinesinamannercommensuratewiththesizeandnatureoftheiractivities,andtheextenttowhichtheiruseofAIcouldleadtomaterialriskstothem.AIcanbeappliedtoawiderangeofusecases,andtherisksassociatedwithdifferentuseofAImayvarybasedonthescale,scopeandbusinessmodelsofFIs.

4Theseincludelocally-incorporatedFIsfromthebankingandinsurancesectors.

5AsdefinedintheCybersecurityAct2018.

6ThefollowingareillustrativeexamplesofAItechniquesandapplicationsthatwouldgenerallyfallwithinthedefinitionabove.Thislistisnon-exhaustive,andnewertechniquesandapplicationsnotlistedhereshouldbeassessedagainstthisdefinition.Currentexamplesincludemachinelearning(includingsupervised,unsupervised,andreinforcementlearning),deeplearning,naturallanguageprocessing,computervision,generativeAI(includinglargelanguagemodels),andAIagents(includingmulti-agentsystems).Fortheavoidanceofdoubt,rule-basedsystems,toolswhoseoutputsarefullydeterminedbyexplicitformulaethatweremanuallyspecified,ratherthanderivedfromdata,androboticprocessautomationthatfollowsfixedprogrammedinstructionswithoutlearningoradaptationwouldnotordinarilybeconsideredAIforthepurposeoftheseGuidelines.

7WhereapointpertainsspecificallytoanAIusecase,AIsystemorAImodel,wewillusetherespectivetermsexplicitlyintheseGuidelines.

7OCTOBER2026|5

GuidelinesonArtificialIntelligenceRiskManagement

1.7.GiventhepaceofAIdevelopments,MASalsoexpectsFIstoregularlyreviewtheadequacyoftheirAIriskmanagementeffortsagainstAIdevelopmentsandaddressneworaccentuatedrisksthatmayariseduetosuchdevelopments.

1.8.TheseGuidelinestakeeffecton7October2027.FIsmaymeettheexpectationssetoutinSections3to

4from7October2027,andSection5and6oftheGuidelinesby7October2028.

Risks

1.9.TheuseofAIcanimproveperformanceacrossbusinessandfunctionalareasbutitscomplexityandprobabilisticnaturecanleadtogreateruncertainty,aswellasunexpectedormorebiasedbehaviourthatishardertoidentifycomparedtotheuseofsimplermethod

s8.

ThegreatercomplexityofAIalsoleadstochallengesinunderstandingandexplainingitsoutputsthatmaybeinaccurateorbiased.RisksfromAIuseisoftenanextensionofexistingriskcategories;suchrisksinclude:

(a)Financialrisks,e.g.,whenusedforriskmanagement,thegreateruncertaintyandunexpectedbehaviourofAIcouldleadtopoorriskassessmentsandconsequentfinanciallosses.

(b)Operationalrisks,e.g.,unexpectedbehaviourofAIusedtoautomateanFI’soperationscouldleadtooperationaldisruptionsorerrorsincriticalprocesses.

(c)Conductrisk,e.g.,useofAIcanresultinbiasedoutputs,leadingtounfairtreatmentofcertaincustomergroups,abiasforcertaininvestmenttypesoverothers,orconflictsofinterestsbetweenanFIanditscustomers.

(d)Financialcrimerisks,e.g.,whenusedtosupportanti-moneylaunderingefforts,thegreateruncertaintyandunexpectedbehaviourofAIcouldmeanthatsuspicioustransactionsgoundetected.

(e)Reputationalrisks,e.g.,customer-facingsystems,suchaschatbots,couldprovideincorrectinformationormakeoffensiveremarksthatleadtonegativemediaattentionandreputationaldamage.

1.10.WithGenerativeAI,suchexistingrisksassociatedwithAImaybeamplified.ThegreatercomplexityofGenerativeAIgivesrisetoevengreateruncertaintyandunexpectedbehaviourcomparedtoAI.TheunstructurednatureofGenerativeAIinputsandoutputs,andalackofestablishedtechniquesinthis

8Suchuncertaintyorbehaviourmayarisefromthenoisethatisinherentintrainingdata,trainingdatathatmaynotberepresentative,orwhenthemodelencountersscenariosthatarenotpresentinitstrainingdata.Itmayalsoariseduetodataormodeldriftsovertime.

7OCTOBER2026|6

GuidelinesonArtificialIntelligenceRiskManagement

areaalsomakeithardertoevaluateandtest,aswellasunderstandandexplainGenerativeAI’sbehaviourandoutputs.ThediverseandoftenopaquedatasourcesusedinGenerativeAItraining,coupledwithdifficultiesinevaluatingbiasofGenerativeAIoutputs,couldalsoresultindecisionsthatleadtounfaircustomeroutcomes.GenerativeAImayalsoleadtoarangeofotherinter-relatedrisks,suchas:

(a)Securityrisks,e.g.,arisingfromadversarialattacksonGenerativeAIsystemsviapromptinjectionordatapoisonin

g9.

(b)Privacyrisks,e.g.,arisingfromtheleakageofconfidentialorcustomerdataduetotheuseofthird-partyGenerativeAIservices,ortheinappropriateuseofcustomerdatainGenerativeAIwithoutproperconsent.

(c)Legalandintellectualpropertyrisks,e.g.,arisingfromtheuseofGenerativeAItrainedondatathatinfringesexistingcopyrightsorpatents.

(d)Third-partyA

I10

risks,e.g.,arisingfromover-relianceonafewdominantGenerativeAIprovidersformissioncriticalareas,orusingopen-sourcemodelswithpoorsecuritycontrols.

(e)Operationalrisks,e.g.,potentialservicedisruptionsduetoGenerativeAIoutagesandproblemsarisingfrominadequatepre-deploymenttesting.

(f)Human-factorrisks,e.g.,useofshadowAI,poorhumanoversightoverGenerativeAIusedinmissioncriticalareas,automationbiasorskilldegradationduetoover-relianceonGenerativeAI.

1.11.Similarly,theuseofnewertechnologiessuchasAIagents,whichmaybegrantedgreaterautonomyandaccesstotools,couldfurtheramplifytheserisks.Forexample,anAIagentwithaccesstotoolscouldautonomouslyexecuteunauthorisedorerroneousactionsthatarenotalignedwithanFI’sbusinessobjectivesorinacustomer’sbestinterestsduetoadivergencebetweenpre-definedgoalsandhowtheAIagenttranslatedsuchgoalsintoaction

s11.

CompromisedAIagentswithaccesstointernalsystemsandexternaltoolscouldbeusedtoexfiltratesensitivedataorexecutemaliciouscommandsatscale,amplifyingsecurityrisks.

9MoredetailsonsuchrisksarecoveredextensivelyinMAS’InformationPaperonCyberRisksAssociatedwithGenerativeArtificialIntelligence.Thepapercanbeaccessedat

.sg/regulation/circulars/cyber-risks-associated-with-

generative-artificial-intelligence.

10ForthepurposeoftheseGuidelines,third-partyAIreferstoAIsystemsormodels,aswellasservicesortoolsincorporatingorusingAI,thataredeveloped,owned,operatedorprovidedbyanexternalparty,andwhichanFIprocures,subscribesto,accessesorotherwisereliesuponinsupportofitsbusinessactivities.

11FIsmayalsoreferencerelevantframeworksonspecificconsiderationsofrisksandgovernancepracticesforAgenticAI,suchasIMDA’sModelAIGovernanceFrameworkforAgenticAI.Thepapercanbeaccessedat

.sg/-

/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf.

7OCTOBER2026|7

GuidelinesonArtificialIntelligenceRiskManagement

1.12.MASrecognisesthatAIadoptionanditsassociatedriskswillcontinuetoevolvealongside

advancementsinAItechnologies.TheGuidelineswillbeupdatedoraugmentedasnecessary.

7OCTOBER2026|8

GuidelinesonArtificialIntelligenceRiskManagement

2.ApplicationoftheGuidelines

2.1.TheGuidelinesapplytoallFIsinaproportionatemanner,accordingtotheirsizeandriskprofile.

2.2.Unlessparagraph2.3.applies,anFIshould:

(a)Establishframeworks,policiesandprocedurestooverseeitsuseofAI,includingclearidentificationofAIusecases,robustriskmaterialityassessmentsandanadequateAIinventory,assetoutinSections3and4oftheseGuidelines.Thescopeofsuchoversight,policiesandproceduresmaybeproportionatetothesizeandnatureoftheFI’sactivities,itsuseofAIanditsriskprofile;and

(b)Applyrelevantlifecyclecontrols,andestablishadequatecapabilitiesandtechnologyinfrastructurefortheuseofAI,assetoutinSections5and6oftheseGuidelines.Suchcontrolsmaybecalibratedbasedontheirrelevanc

e12

totheAIusecases,systemsormodelsintheFI.WheresuchaspectsarerelevanttotheAIusecase,systemormodel,theFImayimplementthembasedontheriskmaterialityoftheAIusecase.

2.3.AnFImayapplybasicAIgovernancepoliciesandprocedures,assetoutinparagraph2.5.,ifthepoorperformanceorunavailabilityoftheAIservicesortoolsusedbytheFIisunlikelytohaveamaterialadverseimpactontheFI,itscustomersorotherstakeholders.Inassessingthepotentialimpact,theFIshouldconsider:

(a)thepotentialfinancial,operational,regulatory,legalorreputationalimpactontheFI;and

(b)thepotentialimpactoncustomersorotherstakeholders,includinginrelationtofairness,ethicalconductandconsumerprotection.

2.4.ExamplesofAIus

e13

thatwouldgenerallyberegardedasmeetingthecriteriainparagraph2.3.are:

(a)UsingAItoassistindrafting,proofreadingorrephrasingemailstocustomers;

(b)UsingAItoassistinsummarisingdocumentsormeetingnotesforinternalreference;

12CertainAIlifecyclecontrols,suchasthoserelatingtotransparency,explainability,andfairnessmaybemorerelevantforAIusedinareassuchascreditscoring,insuranceunderwriting,provisionoffinancialadvisoryorfundmanagementservices.ForAIusedinlowriskmaterialityareastoassisthumansandnotfordecisionmaking,suchascopilotstoassistinwriting,AIlifecyclecontrolsrelatingtoselectionoftheAIsystemsormodels,orcertainevaluationandtestingmethodsforAI,e.g.,stresstesting,maybelessrelevant.However,AIlifecyclecontrolsrelatingtodatamanagement,safetyandcybersecuritywouldberelevantandshouldbeappliedinaproportionatemanner.

13HumansinvolvedintheseAIusecasesshouldbereviewingandcheckingtheoutputsbeforeusingthem.

7OCTOBER2026|9

GuidelinesonArtificialIntelligenceRiskManagement

(c)UsingAItoassistintheinitialrevieworanalysisofdocumentsforinternalreference;

(d)UsingAItoassistingeneratingformulas,chartsorvisualisationsforinternalreference;

(e)UsingAIimagegeneratorstoassistindesigningmarketingorinternalmaterials;and

(f)UsingAI-poweredchatbotstoassistpersonnelinlocatingrelevantinternalresources,suchaspoliciesorprocedures.

2.5.BasicAIgovernancepoliciesandproceduresshouldminimallyincludethefollowing:

(a)clearaccountabilityforAIoversight(e.g.,bydesignatingamemberofseniormanagementasresponsibleforAIoversight);

(b)permittedandprohibitedusesofAI(e.g.,prohibitionsoninputtingconfidential,proprietaryorclientinformationintopublicAItools),togetherwitheffectivehumanoversight(e.g.,circumstanceswhenmandatoryhumanreviewandvalidationofAIoutputspriortouseisrequired);

(c)maintenanceofanapprovedlistofAItools,andadefinedprocessforrequestingapprovalofnewAItools;

(d)staffeducationontheFI’sAI-relatedpolicies;

(e)regularcompliancechecks;and

(f)periodicandtrigger-basedreviewofwhethertheFI’sAIusecontinuestomeetthecriteriainparagraph2.3.

7OCTOBER2026|10

GuidelinesonArtificialIntelligenceRiskManagement

3.AIOversight

3.1.TheboardofdirectorsandseniormanagementofanFIplaycriticalrolesinestablishingandoverseeingrobustframeworks,policiesandprocedurestosupportAIriskmanagementacrosstheFI.

3.2.Theboardandseniormanagementshouldensurethatexistingriskmanagementframeworks,policies,andpracticesacrosstheorganisatio

n14

adequatelyidentify,assess,andaddressrisksposedbyAI.BoardandseniormanagementshouldmaintaineffectiveoversightofrisksfromAIuse,fostertheappropriateriskculturefortheuseofAI,andensurethattheFI’suseofAIwouldnotconflictwithitsabilitytomeetregulatoryrequirementsorothersupervisoryexpectation

s15.

3.3.Theboardandseniormanagementshouldensureconsistentstandards,clearaccountability,androbustcoordinationacrosstheFItomanagerisksfromAIuse.WhiletheFImayadoptvaryingapproachestoAIriskmanagement,suchascreatinganewcentralisedfunctiontomanageallrisksfromAIuse,ormanagingtheincrementalrisksfromAIuseviaexistingriskmanagementfunctions,theboardandseniormanagementshouldstillensureconsistentandcoordinatedmanagementofrisksfromAIuseacrossallrelevantfunction

s16.

3.4.Theboard,oracommitte

e17

delegatedbyit,isresponsiblefor:

(a)approvingandregularlyreviewingtheoverallgovernanceapproachforAIriskmanagement,includingthestrategicdirectionforAIuseandkeyframeworks,structures,policiesandproceduresdesignedtoassessandmanagerisksfromtheFI’suseofAIonanongoingbasis;

(b)ensuringthatrisksfromAIuseareexplicitlyaddressedwithintheFI’sriskappetiteframework,includingqualitativestatementsandquantitativemeasuresforsuchrisksasappropriat

e18;

14KeyexistingriskmanagementareaswhererisksfromAIusearerelevantincludebutarenotlimitedtomodel,operational,reputational,data,technologyandcybersecurity,third-party,legalandcompliance,financial,conduct,andenvironmentalrisks.

15Forexample,anFIshouldcontinuetoadheretoMAS’GuidelinesonFairDealingevenifitleveragesAItodeliverproductsandservices.

16Forexample,byestablishingstructurestocoordinateAIriskmanagementinacross-functionalmanner,suchascross-functionalcommitteesorlinesofcommunicationbetweenfunctions.

17ForanFIwhichispartofaglobalgroup,thecommitteecouldbeagoverningbodyorcommitteebeyondlocalmanagementthatisresponsiblefortheoversightoftheFIinSingapore,suchasaregionalorglobalcommitteewhichexercisesoversightoftherisksfromAIuserelevanttotheFIinSingapore.ForanFIwhichisnotpartofaglobalgroup,thisreferstotheboardofdirectorsoraboard-levelcommitteewhichisdelegatedbytheboardofdirectors.

18Forexample,theFIcouldestablishaqualitativeriskappetitestatementthatarticulatesthetypesandlevelofrisksfromAIusethattheFIiswillingtoaccept,and/orprohibitedusecategories.QuantitativeriskappetitemeasurescouldincludethresholdsonthenumberorfinancialimpactofAI-relatedincidents,numberofmaterialAIusecaseswithdependenciesonasingleprovider,orthenumberofmaterialAIusecasesinbreachofestablishedperformancethresholds.

7OCTOBER2026|11

GuidelinesonArtificialIntelligenceRiskManagement

(c)settingclearrolesandresponsibilitiesfortheboardandseniormanagementconcerningAIriskmanagementoversight;

(d)ensuringithasanadequateunderstandingofAItoprovideeffectiveoversightandchallenge;and

(e)ensuringthattheFI’sapproach,riskappetiteframework,rolesandresponsibilities,capabilitiesandcultureforriskmanagementofAIuseareregularlyreviewedtokeeppacewithnewerAIdevelopments,aswellaschangesintheFI'sriskprofileandbusinessstrategies.

3.5.Seniormanagementisresponsiblefor:

(a)ensuringtheeffectiveimplementationofAI-relatedriskmanagementframeworks,structures,policiesandproceduresacrosstheFI,consistentwiththeFI’sriskappetite;

(b)regularlyreviewingtheeffectivenessoftheAI-relatedriskmanagementframeworks,structures,policiesandprocedures,makingappropriaterevisionstokeeppacewithnewerAIdevelopmentsandchangesintheFI’sriskprofileandbusinessstrategies,aswellasrelevantregulatoryrequirements;

(c)institutingappropriatestrategiesandcontrolstomanagerisksposedbyAIthroughouttheentireAIlifecycle;

(d)establishingclearrolesandresponsibilitiesformanagingrisksfromAIuseacrossdifferentbusinesslinesandfunction

s19,

includingcontrolfunctionsresponsibleforsystemsandprocessesrelatingtoAIidentification,inventorisationandriskmaterialityassessment;

(e)establishinganinternalescalationprocessformanagingmaterialrisksandexceptionsfromAIuse,suchasAIincident

s20

orbreachesofriskthresholds,andensuringappropriateandtimelyactionsaretaken;

(f)updatingtheboardonmaterialAIriskissuesinatimelymanner;and

19Suchrolesandresponsibilitiesmayleveragethethreelinesofdefencemodelifappropriate.Forexample,firstlinefunctionscouldcomprisemodeldevelopersandusersofAI,andmayberesponsibleforareassuchasassessingrisksfromAIusecasesortheapplicationofappropriatehumanoversight.Secondlinefunctionscouldprovideeffectiveandindependentchallengetofirstlinefunctions,andmayberesponsibleforareassuchasindependentvalidationandoverallcompliancewithapplicableregulationsandsupervisoryexpectations.Thethirdline(i.e.internalaudit)couldprovideindependentassuranceontheeffectivenessoftheAIriskmanagementframework.

20ForthepurposeoftheseGuidelines,AIincidentspertaintoincidentsthatinvolveafailure,malfunction,orpoorperformanceoftheunderlyingAIsystem(s)ormodel(s).

7OCTOBER2026|12

GuidelinesonArtificialIntelligenceRiskManagement

(g)ensuringthenecessarycompetenceofpersonnelandallocatingadequateresources(suchashuman,technological,financialresources)foreffectiveAIriskmanagement,includingappropriatetrainingandcapacitybuilding.

3.6.Localseniormanagementremainsaccountableforensuringthatgroupframeworks,ifadoptedforSingapore,adequatelyaddresslocalconsiderationsandregulatoryrequirementsspecifictoSingapore.LocalseniormanagementshouldhaveadequatevisibilityintoandinputonmattersaffectingSingaporeoperations,includingaccesstotimelyandrelevantreportsanddatathatinformdecisionsonhowtomanagerisksfromAIuse.ThereshouldbeclearescalationpathsforSingapore-specificissuestobesurfacedtotheresponsiblepartiestoensuretimelydecision-makingandresolutionoflocalconcerns.LocalseniormanagementshouldalsobeabletodemonstratetoMAShowtheydischargetheiroversightresponsibilities,evenwhenrelyingongroupframeworks.

7OCTOBER2026|13

GuidelinesonArtificialIntelligenceRiskManagement

4.KeyAIRiskManagementSystems,PoliciesandProcedures

4.1.AnFIshouldensurethatitsAIriskmanagementframeworkencompasseskeysystems,policiesandproceduresfortheidentification,inventorisation,andriskmaterialityassessmentofAI.TheFIshouldapplyconsistentandrobustapproachestoidentify,inventoriseanddeterminetheriskmaterialityofAI,andapplycontrolsproportionatetotheassessedriskmateriality.

AIIdentification

4.2.AnFIshouldestablishsystems,policiesandprocedurestoensuretheconsistentidentificationofAIuseacrossallrelevantbusinessandfunctionalareas.Thisidentificationprocessisacriticalprerequisiteforapplyingtheappropriategovernance,riskmanagementstandards,andcontrolseffectivelytoAIthroughouttheirlifecycle.ClearAIdefinitions,criteriaandprocesses,supportedbytoolsandsystemsasappropriate,shouldbeimplementedtofacilitatethisidentificationprocess.WhereAIisincorporatedwithi

n21,

orusedinthedeliveryof,third-partyservices,theidentificationprocessshouldminimallycoversuchAIinservicesprovidedbymaterialthird-partyserviceproviders.

4.3.AnFIshouldassignclearrolesandresponsibilitiesforAIidentification,includingthedesignationofacontrolfunctiontoberesponsibleforAIidentificationsystemsandprocesses.WhiletheactualidentificationofAIusemaybecarriedoutbyrelevantbusinessorfunctionalunits,thedesignatedcontrolfunctionshouldretainsufficientandindependentoversighttoensuretheconsistentapplicationoftheidentificationprocessacrosstheFIincludingtheidentificationofnewAIuseovertime.ItshouldalsobethefinalarbiteronwhetheragivenuseconstitutesAIuse.Thedesignatedcontrolfunctionshouldensurethatcleardocumentationoftheidentificationprocessandoutcomesismaintained,andthatidentificationsystemsandprocessesareregularlyreviewedandupdatedtotakeintoaccountnewerAItechnologiesorintroductionofAIintoexistingthird-partyservices.

4.4.AnFIshouldensurethatresidualrisksfromunidentifiedAIuseremainwithintheFI'sriskappetite.WheretherearepracticalconstraintsinconsistentlyidentifyingallAIuse,e.g.,duetoinadequate

21Forexample,software-as-a-servicewhichmaynotbeexplicitlysoldasAI,butcontainsAIfeaturesthatanFImayaccessoruseaspartofconsumingtheservice.

7O