Risk management begins at the strategic level with the implementation of a suitable governance and organisational structure. Financial entities often develop an AI strategy aligned with their overall strategy, risk strategy and, where applicable, ICT and DOR strategy, and have it approved by their management body. The AI strategy can be a stand-alone strategy, but it can also be integrated into an overarching strategy. Defining an AI strategy becomes particularly significant when AI applications support critical or important functions.
AI strategy. Developing a clear technology roadmap can form the basis of the AI strategy so that the ICT resources, capacities and investments necessary for AI deployment can be defined. AI applications can be seamlessly integrated into existing ICT systems and processes. Continuous innovation management helps to identify and evaluate new technologies and trends in the field of AI.
Throughout a process, it would be helpful to cover and document all steps relevant to the use of AI: from strategy, through development, down to retirement. It is important for the supervised entity to first review all processes relevant to the use of AI to determine whether they are designed for artificial intelligence and whether there is awareness of how to handle information assets before an AI system is implemented.
The development of AI skills is another important aspect. Training and continuing education ensure that employees have the necessary skills and knowledge to interact with AI systems. They thus ensure that employees acquire the knowledge appropriate to their area of responsibility in the user departments (Article 13(6) of DORA). Encouraging talent and building teams of experts in the field of AI are just as important as internal knowledge transfer through documentation and training events. Where AI systems are used, interdisciplinary collaboration is also becoming increasingly important, for example between the IT department and the user departments.
Governance/organisation. With its governance and organisational requirements, DORA is establishing a cornerstone for achieving high digital resilience in financial entities. Setting up an internal governance and control framework plays a key role here. This is intended to ensure effective and prudent management of ICT risks.
The prominent role of the management body is another key building block. In addition to overall responsibility for setting and approving the digital operational resilience strategy and allocating adequate budgetary resources for the ICT risk management framework, this body has ultimate responsibility for managing the ICT risks of the financial entity (Article 5(2)(a) of DORA).
Furthermore, the members of the management body must acquire and maintain sufficient knowledge and skills, including through specialised training, to understand and assess ICT risks and their impact on the financial entity’s operations (Article 5(4) of DORA). It is also necessary for responsibilities to be defined within the organisation and depending on the specific function exercised, e.g. for the use of AI-generated results in decision-making processes.
With regard to general requirements, it is helpful to formulate appropriate guidelines that are consistent with the supervised entity’s (DOR) strategy and its information security policies and guidelines.
Among other things, specific arrangements for ITC third-party service providers and their services should ideally take into account a risk assessment, information from the service provider, and the entity’s own risk reduction measures. The general requirements should be tailored to the specific use case. In addition, the entity should review whether additional AI-specific measures are necessary. In particular, many financial entities adopt risk-based requirements for the use of AI systems, depending on the criticality of the data used and the location of storage and processing.
When AI systems are deployed, it is common for governance frameworks to require the involvement of the ICT risk management function, control functions and internal audit functions. The involvement of these functions depends on the criticality of the AI system, while maintaining independence and avoiding conflicts of interest.