.svg){kind=small}
The famous quote from the IBM manual back in 1979 says that “a computer can never be held accountable, therefore a computer must never make a management decision”.
In a recent note from the RBNZ, there are expectations on other sources of risks, namely the increased cyber risk and third-party and concentration risk. “The core message today is simple: advances in AI are changing the operating environment for financial institutions. Entities are responsible for ensuring that they have the systems and controls in place to manage the risks arising from AI”, RBNZ Assistant Governor Financial Stability Mr McGregor concluded.
From an enterprise perspective, cyber risk considerations are about how the perimeter of the organisation is defended. The underlying risk itself is not new, but is augmented by AI:
The response to those heightened risks are not new as well, and would require enterprises to be rigorously using their defence mechanisms:
.png)
Click to enlarge
In some cases though, the new risks are not AI-augmented attacks, but the reliance on a third party for their product. Fast-paced development and more performing models may mean that some AI applications could have a behaviour inconsistent over time. This can be due to their training, breakthroughs in the model development or configuration settings.
This may not necessarily be a problem – comparing a basic interaction with Generative AI now and from 2023 would show the progress as better response quality, with less discernible patterns for a non-human text generation. However, when AI is used for decision-making or for automated classification, it will be crucial to treat the AI component as a traditional software component; AI systems like Jev3 show that it is possible for AI to be resilient to hallucinations.
In a nutshell, resilience against third party or concentration risk can be demonstrated by healthy change and project management disciplines. Circling back to an idea emitted in our previous article, using AI needs to respond to a business requirement, in the same way that a technology platform is implemented to address a business issue.
AI may be novel technology, but many of the disciplines needed to manage it are not. The real challenge for financial institutions is understanding where AI changes the assumptions on which their existing controls and resilience arrangements were built.
Sources
The famous quote from the IBM manual back in 1979 says that “a computer can never be held accountable, therefore a computer must never make a management decision”.
In a recent note from the RBNZ, there are expectations on other sources of risks, namely the increased cyber risk and third-party and concentration risk. “The core message today is simple: advances in AI are changing the operating environment for financial institutions. Entities are responsible for ensuring that they have the systems and controls in place to manage the risks arising from AI”, RBNZ Assistant Governor Financial Stability Mr McGregor concluded.
From an enterprise perspective, cyber risk considerations are about how the perimeter of the organisation is defended. The underlying risk itself is not new, but is augmented by AI:
The response to those heightened risks are not new as well, and would require enterprises to be rigorously using their defence mechanisms:
