Network Trace
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

04) Do you have processes in place to ensure your service user evaluates the AI model responses before use?

September 11, 2024
Artificial Intelligence

Answer yes if you have ensured, as far as you are able, that your people (employees, managed contract resources or anyone else acting on behalf of your organisation) have reviewed and evaluated the AI model output before use. These processes should help mitigate the risks arising from inaccuracies or ‘hallucinations’ (plausible created statements) within AI outputs which, if applied without human review, can impact integrity and mislead decision-making.

This control is a legal and regulatory requirement for organisations that fall in scope for AML regulation. This is typically:

  • credit institutions;
  • financial institutions;
  • auditors, insolvency practitioners, external accountants and tax advisers;
  • independent legal professionals;
  • trust or company service providers;
  • estate agents;
  • high value dealers;
  • casinos.

It is important that you know your organisations legal requirements for ensuring compliance with AML regulation, and we recommend seeking counsel if you are not sure about your applicability.

The term “anti-money laundering” refers to all policies and pieces of legislation that force institutions to proactively monitor their clients in order to prevent money laundering and corruption. These laws also require both that institutions report any financial crimes they find and that they do everything possible to stop them.

How to implement the control

Consider the operational workflows in which AI processing is applied. Build opportunities for review into those workflows where practicable, and ensure service users are aware of the limitations of AI processing capability, examples of processing flaws, and consequential risks of using that information without review.

When working with generated metrics, consider presentation of the outputs in graphical format to more easily identify anomalous results and outliers compared with expected trends.  Where processing is used to identify outliers to trigger remedial processes (e.g. in ICT process control or dynamic network/computing capacity control), consider if additional data processing and controls can be applied to moderate or verify AI results prior to a system taking action.

If you would like to contribute to this article or provide feedback, please email knowledge@riskledger.com. Contributors will be recognised on our contributors page.

Pattern Trapezoid Mesh

Defend against supply chain attacks with Defend-As-One.

No organisation is an island.