Financial sector sets new baseline guidance for Gen-AI risks

The Cross Market Operational Resilience Group's (CMORG) AI Taskforce has published an AI Baseline Guidance Review aimed at mitigating risks associated with artificial intelligence in the financial services sector.

The guidance has been developed collaboratively with the City of London Corporation, Financial Services Information Sharing and Analysis Center (FS-ISAC), and UK Finance. It addresses generative AI and provides practical advice for handling related risks across operational, reputational, compliance, and cybersecurity domains.

The AI Baseline Guidance Review is described by Amanda Creak, CIO Forum Co-Chair, CMORG, as "the collective insight of a diverse group of experts and is firmly grounded in real-world application. It is intentionally designed to be both adaptable and forward-looking, allowing organisations to tailor it to their own unique needs and enabling responsiveness to emerging challenges and the evolving nature of threats."

The Review is the result of a baseline analysis of existing generative AI risk mitigation frameworks specific to the financial services sector. Its development included input from member firms and draws on cross-sector expertise to develop best practices for generative AI risk management.

The guidance identifies five main areas of practical, methodical direction. The first is government and regulatory approaches, which provides an overview of how authorities balance generative AI opportunities and risks, including a perspective on emerging regulations. Second, the Review discusses risk management principles and frameworks, outlining their relevance in managing operational, reputational, and compliance risks linked to generative AI.

Technical implementation is the third focus area, detailing standards that organisations should consider when implementing control frameworks to manage generative AI-related risks. These standards specifically address data protection and privacy, cyber information security, and model risk.

A fourth theme is third-party and legal considerations. The report advises firms to identify roles and responsibilities along the supply chain and to determine the appropriate use of generative AI solutions by third parties in order to manage related risks.

The fifth area concerns education and awareness, offering guidance on creating and embedding a responsible AI culture within firms, as well as training staff to recognise and address generative AI risks and threats.

The AI Baseline Guidance Review also summarises its observations, provides key takeaways for firms to consider in their individual contexts, and includes a reference section for further exploration of the subject.

Chris Hayward, Policy Chairman, City of London, commented: "There are significant opportunities with artificial intelligence, but we must seize them responsibly. This guidance offers a comprehensive understanding of the complex and evolving risks associated with Gen-AI, encouraging firms to adopt a proactive governance approach that ensures the safe, ethical, and responsible adoption of Gen-AI. By aligning its key takeaways with a commitment to fostering a culture of continuous evaluation and collaboration, firms will be better equipped to unlock Gen-AI's full potential."

Rebecca Gibergues, Executive Director, EMEA, FS-ISAC, said: "Public-private and cross-sector collaboration and information sharing is integral to understanding the risks and benefits Gen-AI poses to the financial sector and its supply chain. Leveraging shared frameworks, principles, and best practices ensures responsible and ethical adoption of Gen-AI, safeguarding stakeholder trust and enhancing the security of the financial sector."

Jana Mackintosh, Managing Director, Payments and Innovation, UK Finance, stated: "As the financial sector increasingly leverages Gen-AI, firms must take a range of considerations into account to ensure risks are appropriately addressed. While there is not a one-size-fits-all solution, firms can adapt this resource to their risk appetite and leverage it in conjunction with other frameworks to achieve effective management of Gen-AI risks. This will help firms make the most of the opportunities these technologies offer."