By sector · Financial services and credit
Financial firms already run model risk management, so most AI duties land on existing controls: model inventories, validation, monitoring, explanations of adverse decisions and vendor oversight. What changes is scope and evidence: credit scoring and insurance pricing are high-risk uses in several instruments, and the explanation given to a consumer is a duty rather than a courtesy.
The controls below map onto validation, monitoring and vendor-management practice a supervised firm has already. The value is in the mapping: knowing which duty a validation report already evidences, and which one still needs a fairness test or a consumer notice.
Several regimes require a specific, reviewable reason for an automated adverse decision. That is a transparency control with a data-governance dependency: the features have to be explainable to be explained.
Sorted by how many of the duties on this page each control satisfies, so the ones worth building first are at the top. A control page lists every other duty it serves, in every jurisdiction.
| Control | Satisfies | Supports | Owner · frequency |
|---|---|---|---|
| Decision explanation, human review and appeal route Process | 4 | 1 | Customer operations lead · once per ai system |
| AI interaction and use disclosure notices Process | 4 | 1 | Product owner · at launch and on material change |
| AI impact and fundamental-rights impact assessment Process | 3 | 2 | AI system owner · once per ai system |
| AI risk assessment and lifecycle risk register Process | 3 | 1 | AI system owner · once per ai system |
| AI incident management and regulatory reporting Process | 3 | 0 | Incident coordinator · continuous |
| Technical documentation, model cards and instructions for use Process | 2 | 2 | Product or model owner · at launch and on material change |
| Automatic event logging and record retention Technical measure | 2 | 1 | Engineering lead · continuous |
| AI governance policy and accountability structure Policy | 2 | 1 | Executive sponsor for AI · annual |
| Post-deployment monitoring and drift detection Technical measure | 1 | 3 | AI system owner · continuous |
| AI system inventory and classification Process | 1 | 2 | AI governance lead · continuous |
| Accuracy, robustness, fairness and security testing Technical measure | 1 | 2 | Quality or testing lead · at launch and on material change |
| Human oversight design and override procedure Process | 1 | 1 | AI system owner · once per ai system |
| Privacy and data-protection controls for AI Process | 1 | 1 | Data protection officer · once per ai system |
| Data governance and dataset documentation Process | 1 | 1 | Data governance lead · once per ai system |
| Prohibited and unacceptable-use screening gate Process | 1 | 0 | AI governance lead · once per ai system |
| Training-data provenance and copyright register Process | 0 | 1 | Model development lead · at launch and on material change |
| Conformity assessment, declaration and registration Process | 0 | 1 | Regulatory compliance lead · once per ai system |
Every published duty whose record names this audience. It is the recorded set, not every rule in the world; a jurisdiction missing here may simply not be mapped yet (open gaps).
Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.
