3. Technical Controls

A. Select Evolving only if all criteria for that level are fully met; otherwise, choose Foundational

A. While data privacy practices are in place, data quality and trustworthiness are areas of focus with initial discussions underway

A. Ad-hoc data validation and cleansing protocols to improve data quality and trustworthiness

A. Data quality checks done at scale with strict data validation and cleansing protocols (using tools, as required)

A. Select Evolving only if all criteria for that level are fully met; otherwise, choose Foundational

A. Some awareness of model risk management with preliminary processes to test and validate AI models

A. Model risk management practices centred on identifying and mitigating risks, catering to different types of models although still fragmented

A. Model risk management process proactively implements risk mitigation practices during the development process to manage risks as they arise (with automation, as required)

AND
B. AI models/solutions are validated using appropriate methods (e.g., statistical tools), ensuring that AI use cases are deployed as intended

AND
C. Open-source packages/libraries utilised in models are carefully managed to ensure proper usage

A. Existing controls are ad-hoc and rely on manual interventions (e.g., human review)

A. Initial efforts have been made to develop a control environment, with documented policies and procedures for using controls

AND
B. Basic technical guardrails implemented (e.g., access controls, firewalls)

A. Developed a control environment (integrating some third-party controls as needed), with limited automation

AND
B. Technical guardrails established (incl. guardrails for system integration), with ongoing refinement and automation using tooling solutions (for data quality, explainability, bias etc.)

A. Control environment is integrated with monitoring systems (in real-time as required) and is documented (with integration into the Internal Control System (ICS), if applicable)

AND
B. AI projects are secured by an advanced guardrail system with automated and manual controls for each relevant AI risk type (e.g., bias, explainability)

AND
C. As applicable, third-party controls are selected and integrated into the control environment

A. Select Evolving only if all criteria for that level are fully met; otherwise, choose Foundational

A. Early stages of monitoring KRIs (e.g., through a dashboard), primarily through manual efforts

AND
B. Preliminary efforts have been made to develop incident response plans

A. Initial automation efforts for monitoring KRIs underway (in real-time, as required)

AND
B. Documented incident response plans with basic escalation protocols, although gaps in coverage

A. Automation implemented for monitoring of KRIs (in real-time, as required), covering relevant areas and leveraging human in / on the loop, as required

AND
B. Established an incident response plan for AI system failures with regular testing and updates, and clear escalation protocols (as required)