Role
Risk officer, financial services
A supervised firm owes these duties as an institution, whether it built the system, bought it or inherited it.
§ 1 — What you carry
Where the duty attaches
These instruments bind by institution rather than by role in a supply chain, which makes them unusual in this corpus and much harder to delegate. There is no capacity to disclaim: the technology risk and operational resilience duties are owed by the firm, and outsourcing the system does not outsource them.
Two supervisory regimes are represented below, and they ask for different things. One is built around technology risk management and the board’s oversight of it; the other around operational resilience, third-party arrangements and the register of them. A firm in scope of both is not doing the work twice, but it is evidencing it twice.
Also written as chief risk officer, operational risk manager, model risk manager. Everything below is drawn from the obligation dataset by the capacity that binds this role, not by job title — 4 provisions across 1 collection.
§ 2 — The obligations
What binds you
MAS and AI in financial institutions
4 provisions
§ 3 — Evidence
The artefacts this role owns
Drawn from the evidence column of the provisions above, most widely demanded first. These are what an assessor asks this role to produce.
- 1xA data-flow map for one use case, caches included
- 1xA deletion request executed to completion, indexes included
- 1xA finding the development team did not simply accept
- 1xA re-rating triggered by a change in the system
- 1xA step-independence test run against the deployed system
- 1xAccess evidence at artefact level, service accounts included
- 1xEnvelope authentication evidence, not envelope storage
- 1xEscalation service levels with the decision recorded
- 1xOne independent validation report with the stake declared
- 1xThe action-type catalogue with a disposition assigned to each
- 1xThe derivation of each Deny control to a named source
- 1xThe distribution of ratings across the AI population
Certification
Assessed on the same standard of evidence
Every Council credential is examined on applied judgement against a published anchor, set out the way the obligations on this page are. The Certified Applied AI Associate, the Council’s flagship, is open to any adult today, its fee waived by a coupon code from the AI-Readiness Check, and the register lists what is open for enrolment.