To fully leverage generative AI services at scale and speed, Banks and Insurers need to uplift their existing risk and control frameworks
Generative AI is expected to impact most of a financial institution's operational capabilities. While most Banks and Insurers are finding early success with generative AI PoCs, there is no clear, consistent, compliant path to production. Regulators such as the Monetary Authority of Singapore (MAS), vendors and non profit organisations have published early guidance and principles. However, designing, implementing and monitoring effective AI controls remains the sole responsibility of the regulated entity.
New
Confidentiality & Privacy
Inaccuracy ("hallucination")
Ethics and impact
Insecure output handling
Fairness and Bias
Misuse
IP Protection & Infringement
Overreliance
Legal and regulatory
Prompt injection
Existing
Sensitive information disclosure
Transparency & Explainability
Building for compliance and speed without compromise
To address these risks efficiently and at scale, Engineers, Architects and Risk professionals need to come together to execute the following:
- Understand how extensible existing controls are to cover AI risks
- Conduct risk in change assessments to fully understand the new risks introduced by generative AI
- Establish approved patterns for AI control implementation and monitoring
Readiness planning for uplifting FI risk frameworks for gen AI
The Newton Russell readiness framework is guided by NIST’s AI RMF 1.0 and Singapore’s AI Verify Framework.
.png)
In addition to assessing current state control environments, the assessment scope covers new capabilities specific to AI solutions, including:
- Input context (data and documents)
- Prompt engineering and Retrieval Augment Generation (RAG)
- Outputs and output governance
- Human-in-the-loop and feedback mechanisms
Getting started: Rapid discovery and prototyping
A three week readiness planning exercise can quickly bring teams together to understand the current state of control readiness, gaps that need to be addressed and devise a control uplift implementation plan.
Benefits of this approach
- Aligning risk practices modern ways of working
- Aligning new generative AI practices to existing risk frameworks and policies
- Simplifying risk assessment approvals for generative AI programs without compromising compliance obligations
