Using AI systems offers significant potential for financial entities, not least due to more efficient internal processes and more granular risk management. However, increased use of AI also entails greater risks.
It is therefore necessary for financial entities to first define appropriate governance and organisational structures to mitigate ICT risks arising from AI systems. DORA specifies sufficient requirements to establish an effective ICT risk management framework for such systems.
Developing and testing AI systems poses particular challenges for entities. This is due to the often-high complexity of the mathematical models, the amount of data to be processed, and the integration of software from ICT third-party service providers. AI systems developed internally and externally must be analysed and tested according to the same standards.
Appropriate processes must be defined for AI system operation. These should identify risks and ICT incidents throughout the entire AI system lifecycle and initiate countermeasures. Because AI systems often run in cloud environments, the requirements for using ICT third-party service providers must be interpreted accordingly.
As financial entities use AI systems to process confidential data, typically customer data, the systems must be secured against unauthorised access and data leaks. Cyber- and data security are very important, which may require significant efforts on the part of the entities to classify data into confidentiality levels. Suitable reporting processes must be established for major ICT-related incidents.
These requirements are particularly relevant for AI assistants, which are often included in standard software. Implementing AI assistance systems at a financial services entity requires a holistic security strategy that encompasses technical, organisational and regulatory measures.