1. Set the governance mandate
Define the entities, funds, strategies, teams, jurisdictions, obligations, systems and decisions covered by the governance programme.
Controlled evidence includes entity; fund; strategy; jurisdiction; obligation; owner; exclusion; approval. The immediate decision is to freeze scope, authority and review cadence. Definitions should remain stable across investment, risk, committee, operational and financial records.
Governance evidence should remain entity-, fund-, strategy-, use-case-, decision-, provider-, jurisdiction- and period-specific. Reviews should preserve missing records, failed cases, overrides, exceptions, adverse outcomes and remediation evidence.
The analytical unit should remain stable from source record to valuation conclusion. Reviewers should see the population, exclusions, period, owner and reconciliation to finance. Where evidence is incomplete, the model should retain a range and identify the action needed to narrow it. Comparisons should preserve product, customer, site, complexity and market conditions; aggregation should not conceal adverse cohorts or delayed consequences.
2. Build the enterprise AI inventory
Record every model, agent, prompt library, embedded feature, connector, dataset, vendor and material user group in one controlled register.
Controlled evidence includes component; version; purpose; owner; provider; data; users; status. The immediate decision is to make the deployed estate visible. Definitions should remain stable across investment, risk, committee, operational and financial records.
The governing body should distinguish observation, automated output, professional judgment, approval and completed action. Each projected benefit needs full cost, accountable ownership and a route to collected fees, protected cash or sustained value.
Evidence should distinguish observation, estimate, management plan and transaction judgement. A supported claim includes timing, full cost, dependency, transferability and a cash consequence. Sensitivity should show how the conclusion changes when adoption, demand, quality or persistence underperforms. Material assumptions need validation dates, accountable owners and explicit expiry conditions so that stale expectations do not survive into pricing or financing decisions.
3. Register use cases and outcomes
Each use case should state the business problem, workflow, affected parties, intended benefit and prohibited actions.
Controlled evidence includes use case; problem; process; beneficiary; output; action; exclusion; metric. The immediate decision is to connect technology to a bounded business purpose. Definitions should remain stable across investment, risk, committee, operational and financial records.
Investment, operations, finance, legal, compliance, technology, risk and investor-relations teams should use stable identifiers and definitions. Material outputs should be traced from source through transformation, review, approval, action and outcome.
The operating team and finance team should use the same definitions. Native records should support aggregate dashboards, and sample testing should follow representative cases from input through outcome and cash. Exceptions, failed cases and client concessions remain part of the population. Reconciliation should cover opening and closing balances, acquisitions, disposals, foreign exchange, allocation changes and manual adjustments that could otherwise mimic operating improvement.
4. Tier risk by consequence
Risk classification should reflect financial, fiduciary, investor, market, regulatory, contractual, privacy and operational consequences.
Controlled evidence includes tier; decision; exposure; party; obligation; severity; reversibility; approval. The immediate decision is to apply controls proportionate to actual consequence. Definitions should remain stable across investment, risk, committee, operational and financial records.
Material risks include opaque models, weak data rights, misleading claims, conflicts, biased errors, control bypass, data leakage, vendor concentration, service failure and unowned remediation.
Decision makers need both upside and downside. The analysis should state which party controls conversion, what investment remains, when cash appears, which risks survive and whether the result continues after a change of ownership. Unsupported precision should be replaced with bounded scenarios. The committee should record the decision consequence of each range, including price, structure, funding, covenant, integration and monitoring implications.
5. Map decision rights
Retrieval, analysis, recommendation, approval, instruction, execution and disclosure require distinct authorities.
Controlled evidence includes activity; AI role; human role; reviewer; approver; prohibition; escalation; record. The immediate decision is to prevent automation from acquiring unstated authority. Definitions should remain stable across investment, risk, committee, operational and financial records.
Governance evidence should remain entity-, fund-, strategy-, use-case-, decision-, provider-, jurisdiction- and period-specific. Reviews should preserve missing records, failed cases, overrides, exceptions, adverse outcomes and remediation evidence.
The analytical unit should remain stable from source record to valuation conclusion. Reviewers should see the population, exclusions, period, owner and reconciliation to finance. Where evidence is incomplete, the model should retain a range and identify the action needed to narrow it. Comparisons should preserve product, customer, site, complexity and market conditions; aggregation should not conceal adverse cohorts or delayed consequences.
Table 1. AI decision-authority matrix
| AI activity | Human authority | Required evidence |
|---|---|---|
| retrieve and classify | review material exceptions | source and version |
| analyse and draft | challenge and approve use | inputs, method and limits |
| recommend | make accountable decision | alternatives and rationale |
| execute or communicate | authorise consequential action | approval and outcome |
Replace illustrative classifications with company-specific evidence and approved transaction treatment.
Inventory completeness should extend from sanctioned models to embedded features, agents, connectors and shadow use.
6. Anchor fiduciary and conduct obligations
The governing body should map each use case to applicable duties, client interests, fund documents and supervisory expectations.
Controlled evidence includes duty; client; mandate; rule; use case; evidence; owner; review. The immediate decision is to keep existing responsibilities attached to AI-enabled work. Definitions should remain stable across investment, risk, committee, operational and financial records.
The governing body should distinguish observation, automated output, professional judgment, approval and completed action. Each projected benefit needs full cost, accountable ownership and a route to collected fees, protected cash or sustained value.
Evidence should distinguish observation, estimate, management plan and transaction judgement. A supported claim includes timing, full cost, dependency, transferability and a cash consequence. Sensitivity should show how the conclusion changes when adoption, demand, quality or persistence underperforms. Material assumptions need validation dates, accountable owners and explicit expiry conditions so that stale expectations do not survive into pricing or financing decisions.
7. Establish model lineage
Foundation models, fine-tunes, retrieval systems, rules and downstream transformations need traceable versions and dependencies.
Controlled evidence includes model; provider; version; training disclosure; retrieval; rule; transformation; output. The immediate decision is to reconstruct how a material output was produced. Definitions should remain stable across investment, risk, committee, operational and financial records.
Investment, operations, finance, legal, compliance, technology, risk and investor-relations teams should use stable identifiers and definitions. Material outputs should be traced from source through transformation, review, approval, action and outcome.
The operating team and finance team should use the same definitions. Native records should support aggregate dashboards, and sample testing should follow representative cases from input through outcome and cash. Exceptions, failed cases and client concessions remain part of the population. Reconciliation should cover opening and closing balances, acquisitions, disposals, foreign exchange, allocation changes and manual adjustments that could otherwise mimic operating improvement.
8. Establish data lineage
Investment, investor, portfolio, employee and market data should be traced from source through processing to decision and retention.
Controlled evidence includes dataset; source; licence; purpose; location; transformation; output; retention. The immediate decision is to prove which evidence entered each use case. Definitions should remain stable across investment, risk, committee, operational and financial records.
Material risks include opaque models, weak data rights, misleading claims, conflicts, biased errors, control bypass, data leakage, vendor concentration, service failure and unowned remediation.
Decision makers need both upside and downside. The analysis should state which party controls conversion, what investment remains, when cash appears, which risks survive and whether the result continues after a change of ownership. Unsupported precision should be replaced with bounded scenarios. The committee should record the decision consequence of each range, including price, structure, funding, covenant, integration and monitoring implications.
9. Govern privacy and confidentiality
Personal, confidential, inside and commercially sensitive information require lawful purpose, access boundaries and deletion controls.
Controlled evidence includes data class; subject; purpose; consent; access; location; retention; deletion. The immediate decision is to keep processing within evidenced rights. Definitions should remain stable across investment, risk, committee, operational and financial records.
Governance evidence should remain entity-, fund-, strategy-, use-case-, decision-, provider-, jurisdiction- and period-specific. Reviews should preserve missing records, failed cases, overrides, exceptions, adverse outcomes and remediation evidence.
The analytical unit should remain stable from source record to valuation conclusion. Reviewers should see the population, exclusions, period, owner and reconciliation to finance. Where evidence is incomplete, the model should retain a range and identify the action needed to narrow it. Comparisons should preserve product, customer, site, complexity and market conditions; aggregation should not conceal adverse cohorts or delayed consequences.
10. Protect intellectual property
Prompts, models, code, documents, portfolio information and generated outputs require ownership, licence and infringement controls.
Controlled evidence includes asset; owner; licence; input; output; restriction; review; remedy. The immediate decision is to avoid hidden rights and provenance failures. Definitions should remain stable across investment, risk, committee, operational and financial records.
The governing body should distinguish observation, automated output, professional judgment, approval and completed action. Each projected benefit needs full cost, accountable ownership and a route to collected fees, protected cash or sustained value.
Evidence should distinguish observation, estimate, management plan and transaction judgement. A supported claim includes timing, full cost, dependency, transferability and a cash consequence. Sensitivity should show how the conclusion changes when adoption, demand, quality or persistence underperforms. Material assumptions need validation dates, accountable owners and explicit expiry conditions so that stale expectations do not survive into pricing or financing decisions.
11. Secure human and machine identities
Users, service accounts, agents and connectors need least privilege, credential protection and rapid revocation.
Controlled evidence includes identity; role; privilege; credential; system; event; approval; revocation. The immediate decision is to reduce unauthorised access and action. Definitions should remain stable across investment, risk, committee, operational and financial records.
Investment, operations, finance, legal, compliance, technology, risk and investor-relations teams should use stable identifiers and definitions. Material outputs should be traced from source through transformation, review, approval, action and outcome.
The operating team and finance team should use the same definitions. Native records should support aggregate dashboards, and sample testing should follow representative cases from input through outcome and cash. Exceptions, failed cases and client concessions remain part of the population. Reconciliation should cover opening and closing balances, acquisitions, disposals, foreign exchange, allocation changes and manual adjustments that could otherwise mimic operating improvement.
12. Diligence AI vendors
Diligence should cover capability, limitations, security, privacy, resilience, financial strength, governance and regulatory cooperation.
Controlled evidence includes provider; service; model; control; audit; incident; financial condition; reviewer. The immediate decision is to approve vendors on evidence rather than demonstrations. Definitions should remain stable across investment, risk, committee, operational and financial records.
Material risks include opaque models, weak data rights, misleading claims, conflicts, biased errors, control bypass, data leakage, vendor concentration, service failure and unowned remediation.
Decision makers need both upside and downside. The analysis should state which party controls conversion, what investment remains, when cash appears, which risks survive and whether the result continues after a change of ownership. Unsupported precision should be replaced with bounded scenarios. The committee should record the decision consequence of each range, including price, structure, funding, covenant, integration and monitoring implications.
Table 2. Vendor-control architecture
| Layer | Evidence | Failure risk |
|---|---|---|
| provider | capability, ownership and resilience | unfit or unstable supplier |
| model and data | versions, provenance and rights | opaque dependency |
| contract | audit, change, incident and exit rights | control gap |
| operations | monitoring, continuity and substitution | service concentration |
Replace illustrative classifications with company-specific evidence and approved transaction treatment.
Control intensity should rise with financial, fiduciary, investor, regulatory and operational consequence.
13. Contract for control
Terms should address data use, training, sub-processors, service changes, audit rights, incidents, liability, portability, termination and assistance.
Controlled evidence includes contract; right; obligation; notification; audit; liability; exit; approval. The immediate decision is to convert vendor promises into enforceable controls. Definitions should remain stable across investment, risk, committee, operational and financial records.
Governance evidence should remain entity-, fund-, strategy-, use-case-, decision-, provider-, jurisdiction- and period-specific. Reviews should preserve missing records, failed cases, overrides, exceptions, adverse outcomes and remediation evidence.
Keep each provider and dependency tied to an approved use case. Show ownership, contract rights, sub-processors, data routes, service evidence, incidents and exit feasibility. Test the correct fund, strategy, geography and operating period. Retain weak evidence, failed controls, overrides, delayed consequences and remediation proof.
14. Map sub-processors and concentration
Common clouds, model providers, data services and specialist vendors can create correlated failure across funds and managers.
Controlled evidence includes provider; sub-processor; service; region; dependency; concentration; substitute; exit. The immediate decision is to see common-mode dependencies before disruption. Definitions should remain stable across investment, risk, committee, operational and financial records.
The governing body should distinguish observation, automated output, professional judgment, approval and completed action. Each projected benefit needs full cost, accountable ownership and a route to collected fees, protected cash or sustained value.
Evidence should distinguish observation, estimate, management plan and transaction judgement. A supported claim includes timing, full cost, dependency, transferability and a cash consequence. Sensitivity should show how the conclusion changes when adoption, demand, quality or persistence underperforms. Material assumptions need validation dates, accountable owners and explicit expiry conditions so that stale expectations do not survive into pricing or financing decisions.
15. Design meaningful human oversight
Oversight requires competent people with enough information, time, independence and authority to challenge or stop an action.
Controlled evidence includes decision; evidence; reviewer; competence; time; override; escalation; outcome. The immediate decision is to make human control operational. Definitions should remain stable across investment, risk, committee, operational and financial records.
Investment, operations, finance, legal, compliance, technology, risk and investor-relations teams should use stable identifiers and definitions. Material outputs should be traced from source through transformation, review, approval, action and outcome.
The operating team and finance team should use the same definitions. Native records should support aggregate dashboards, and sample testing should follow representative cases from input through outcome and cash. Exceptions, failed cases and client concessions remain part of the population. Reconciliation should cover opening and closing balances, acquisitions, disposals, foreign exchange, allocation changes and manual adjustments that could otherwise mimic operating improvement.
16. Validate before approval
Representative tests should cover expected cases, edge cases, adverse inputs, stale evidence, prompt attacks and consequential errors.
Controlled evidence includes population; test; expected result; observed result; error; consequence; reviewer; approval. The immediate decision is to bound approved use to evidenced performance. Definitions should remain stable across investment, risk, committee, operational and financial records.
Material risks include opaque models, weak data rights, misleading claims, conflicts, biased errors, control bypass, data leakage, vendor concentration, service failure and unowned remediation.
Decision makers need both upside and downside. The analysis should state which party controls conversion, what investment remains, when cash appears, which risks survive and whether the result continues after a change of ownership. Unsupported precision should be replaced with bounded scenarios. The committee should record the decision consequence of each range, including price, structure, funding, covenant, integration and monitoring implications.
17. Red-team material use cases
Independent challenge should test manipulation, data leakage, unsafe actions, conflicts, hallucination and control evasion.
Controlled evidence includes scenario; attack; target; result; severity; containment; owner; remediation. The immediate decision is to discover failure paths before production exposure. Definitions should remain stable across investment, risk, committee, operational and financial records.
Governance evidence should remain entity-, fund-, strategy-, use-case-, decision-, provider-, jurisdiction- and period-specific. Reviews should preserve missing records, failed cases, overrides, exceptions, adverse outcomes and remediation evidence.
The analytical unit should remain stable from source record to valuation conclusion. Reviewers should see the population, exclusions, period, owner and reconciliation to finance. Where evidence is incomplete, the model should retain a range and identify the action needed to narrow it. Comparisons should preserve product, customer, site, complexity and market conditions; aggregation should not conceal adverse cohorts or delayed consequences.
18. Set performance thresholds
Accuracy should be supplemented with coverage, false negatives, calibration, stability, latency, abstention and downstream rework.
Controlled evidence includes metric; denominator; threshold; period; cohort; failure; owner; action. The immediate decision is to measure performance by decision consequence. Definitions should remain stable across investment, risk, committee, operational and financial records.
The governing body should distinguish observation, automated output, professional judgment, approval and completed action. Each projected benefit needs full cost, accountable ownership and a route to collected fees, protected cash or sustained value.
Evidence should separate facts, calculations, judgment and planned action. Each output needs a source, owner, period, cost, control and consequence. Tests should show how results change when volume, quality, timing or system performance weakens. Rules need review dates, owners and expiry conditions; stale logic should not govern records or payments.
19. Test bias and disparate effects
Data, labels, proxies, selection and workflow design can distribute errors and opportunities unevenly across affected groups.
Controlled evidence includes population; feature; outcome; error; comparison; cause; reviewer; remedy. The immediate decision is to identify material unfairness and unsupported proxies. Definitions should remain stable across investment, risk, committee, operational and financial records.
Investment, operations, finance, legal, compliance, technology, risk and investor-relations teams should use stable identifiers and definitions. Material outputs should be traced from source through transformation, review, approval, action and outcome.
The operating team and finance team should use the same definitions. Native records should support aggregate dashboards, and sample testing should follow representative cases from input through outcome and cash. Exceptions, failed cases and client concessions remain part of the population. Reconciliation should cover opening and closing balances, acquisitions, disposals, foreign exchange, allocation changes and manual adjustments that could otherwise mimic operating improvement.
20. Calibrate explainability
The explanation required should reflect the recipient, decision, consequence, confidentiality and available challenge route.
Controlled evidence includes audience; decision; rationale; evidence; limitation; challenge; reviewer; record. The immediate decision is to make material decisions understandable enough to govern. Definitions should remain stable across investment, risk, committee, operational and financial records.
Material risks include opaque models, weak data rights, misleading claims, conflicts, biased errors, control bypass, data leakage, vendor concentration, service failure and unowned remediation.
Decision makers need both upside and downside. The analysis should state which party controls conversion, what investment remains, when cash appears, which risks survive and whether the result continues after a change of ownership. Unsupported precision should be replaced with bounded scenarios. The committee should record the decision consequence of each range, including price, structure, funding, covenant, integration and monitoring implications.
Table 3. Material-use validation
| Test | Evidence | Decision |
|---|---|---|
| population | coverage and exclusions | bound approved scope |
| performance | errors, calibration and stability | set threshold |
| adversarial | misuse and control-evasion results | remediate weakness |
| workflow | human challenge and outcome | approve or stop |
Replace illustrative classifications with company-specific evidence and approved transaction treatment.
Human authority should remain strongest where outputs become recommendations, records, communications or actions.
21. Preserve records and reproducibility
Policies, inputs, versions, outputs, overrides, approvals, incidents and outcomes should remain retrievable by obligation and period.
Controlled evidence includes record; source; version; actor; timestamp; decision; retention; retrieval. The immediate decision is to reconstruct each material AI-assisted action. Definitions should remain stable across investment, risk, committee, operational and financial records.
Governance evidence should remain entity-, fund-, strategy-, use-case-, decision-, provider-, jurisdiction- and period-specific. Reviews should preserve missing records, failed cases, overrides, exceptions, adverse outcomes and remediation evidence.
The analytical unit should remain stable from source record to valuation conclusion. Reviewers should see the population, exclusions, period, owner and reconciliation to finance. Where evidence is incomplete, the model should retain a range and identify the action needed to narrow it. Comparisons should preserve product, customer, site, complexity and market conditions; aggregation should not conceal adverse cohorts or delayed consequences.
22. Control external disclosures
Fundraising, investor, regulatory and public statements about AI should be accurate, supportable, current and consistent with actual use.
Controlled evidence includes claim; audience; source; limitation; reviewer; approval; date; correction. The immediate decision is to prevent misleading capability and performance claims. Definitions should remain stable across investment, risk, committee, operational and financial records.
The governing body should distinguish observation, automated output, professional judgment, approval and completed action. Each projected benefit needs full cost, accountable ownership and a route to collected fees, protected cash or sustained value.
Evidence should distinguish observation, estimate, management plan and transaction judgement. A supported claim includes timing, full cost, dependency, transferability and a cash consequence. Sensitivity should show how the conclusion changes when adoption, demand, quality or persistence underperforms. Material assumptions need validation dates, accountable owners and explicit expiry conditions so that stale expectations do not survive into pricing or financing decisions.
23. Manage conflicts and incentives
AI may optimise for fees, allocations, retention, speed or conversion in ways that conflict with duties or client interests.
Controlled evidence includes objective; incentive; affected party; conflict; control; disclosure; reviewer; outcome. The immediate decision is to surface and govern objective-function conflicts. Definitions should remain stable across investment, risk, committee, operational and financial records.
Investment, operations, finance, legal, compliance, technology, risk and investor-relations teams should use stable identifiers and definitions. Material outputs should be traced from source through transformation, review, approval, action and outcome.
The operating team and finance team should use the same definitions. Native records should support aggregate dashboards, and sample testing should follow representative cases from input through outcome and cash. Exceptions, failed cases and client concessions remain part of the population. Reconciliation should cover opening and closing balances, acquisitions, disposals, foreign exchange, allocation changes and manual adjustments that could otherwise mimic operating improvement.
24. Govern investment-committee use
AI-supported screening, diligence, scenarios and recommendations should preserve source evidence, dissent and accountable judgment.
Controlled evidence includes opportunity; source; analysis; scenario; recommendation; challenge; vote; outcome. The immediate decision is to keep committee responsibility visible. Definitions should remain stable across investment, risk, committee, operational and financial records.
Material risks include opaque models, weak data rights, misleading claims, conflicts, biased errors, control bypass, data leakage, vendor concentration, service failure and unowned remediation.
Decision makers need both upside and downside. The analysis should state which party controls conversion, what investment remains, when cash appears, which risks survive and whether the result continues after a change of ownership. Unsupported precision should be replaced with bounded scenarios. The committee should record the decision consequence of each range, including price, structure, funding, covenant, integration and monitoring implications.
25. Govern valuation use
Comparable selection, forecasts, adjustments and scenario models need approved methods, dated evidence, sensitivity and independent review.
Controlled evidence includes asset; method; input; comparable; adjustment; scenario; reviewer; approval. The immediate decision is to prevent opaque precision from driving marks. Definitions should remain stable across investment, risk, committee, operational and financial records.
Governance evidence should remain entity-, fund-, strategy-, use-case-, decision-, provider-, jurisdiction- and period-specific. Reviews should preserve missing records, failed cases, overrides, exceptions, adverse outcomes and remediation evidence.
The analytical unit should remain stable from source record to valuation conclusion. Reviewers should see the population, exclusions, period, owner and reconciliation to finance. Where evidence is incomplete, the model should retain a range and identify the action needed to narrow it. Comparisons should preserve product, customer, site, complexity and market conditions; aggregation should not conceal adverse cohorts or delayed consequences.
26. Govern portfolio-company deployment
Operating teams need clear boundaries where GP tools access portfolio data or influence customers, workers, pricing and operations.
Controlled evidence includes company; use case; dataset; stakeholder; decision; control; owner; outcome. The immediate decision is to separate support, authority and company accountability. Definitions should remain stable across investment, risk, committee, operational and financial records.
The governing body should distinguish observation, automated output, professional judgment, approval and completed action. Each projected benefit needs full cost, accountable ownership and a route to collected fees, protected cash or sustained value.
Evidence should distinguish observation, estimate, management plan and transaction judgement. A supported claim includes timing, full cost, dependency, transferability and a cash consequence. Sensitivity should show how the conclusion changes when adoption, demand, quality or persistence underperforms. Material assumptions need validation dates, accountable owners and explicit expiry conditions so that stale expectations do not survive into pricing or financing decisions.
27. Govern fundraising and LP scouting
Prospecting, personalisation and relationship scoring should respect data rights, communications rules and truthful representation.
Controlled evidence includes prospect; source; purpose; message; score; reviewer; consent; outcome. The immediate decision is to protect trust while improving origination. Definitions should remain stable across investment, risk, committee, operational and financial records.
Investment, operations, finance, legal, compliance, technology, risk and investor-relations teams should use stable identifiers and definitions. Material outputs should be traced from source through transformation, review, approval, action and outcome.
The operating team and finance team should use the same definitions. Native records should support aggregate dashboards, and sample testing should follow representative cases from input through outcome and cash. Exceptions, failed cases and client concessions remain part of the population. Reconciliation should cover opening and closing balances, acquisitions, disposals, foreign exchange, allocation changes and manual adjustments that could otherwise mimic operating improvement.
28. Govern investor reporting
Generated commentary, attribution, exposure, performance and risk statements should reconcile to approved books and source evidence.
Controlled evidence includes investor; vehicle; period; metric; narrative; source; reviewer; release. The immediate decision is to publish complete and supportable communications. Definitions should remain stable across investment, risk, committee, operational and financial records.
Material risks include opaque models, weak data rights, misleading claims, conflicts, biased errors, control bypass, data leakage, vendor concentration, service failure and unowned remediation.
Decision makers need both upside and downside. The analysis should state which party controls conversion, what investment remains, when cash appears, which risks survive and whether the result continues after a change of ownership. Unsupported precision should be replaced with bounded scenarios. The committee should record the decision consequence of each range, including price, structure, funding, covenant, integration and monitoring implications.
29. Govern fund-administration interfaces
Subscriptions, cash, fees, NAV, statements and filings should remain bound to governing documents and authorised records.
Controlled evidence includes vehicle; investor; transaction; calculation; record; exception; approval; outcome. The immediate decision is to keep operational automation within mandate. Definitions should remain stable across investment, risk, committee, operational and financial records.
Governance evidence should remain entity-, fund-, strategy-, use-case-, decision-, provider-, jurisdiction- and period-specific. Reviews should preserve missing records, failed cases, overrides, exceptions, adverse outcomes and remediation evidence.
Representative tests should retain the expected result, observed result, error consequence, reviewer decision and approved use boundary.
30. Design operational resilience
Important services need mapped dependencies, impact tolerances, continuity arrangements and recovery tests that include AI providers.
Controlled evidence includes service; dependency; tolerance; scenario; continuity; recovery; test; owner. The immediate decision is to maintain service through model or provider failure. Definitions should remain stable across investment, risk, committee, operational and financial records.
The governing body should distinguish observation, automated output, professional judgment, approval and completed action. Each projected benefit needs full cost, accountable ownership and a route to collected fees, protected cash or sustained value.
Evidence should distinguish observation, estimate, management plan and transaction judgement. A supported claim includes timing, full cost, dependency, transferability and a cash consequence. Sensitivity should show how the conclusion changes when adoption, demand, quality or persistence underperforms. Material assumptions need validation dates, accountable owners and explicit expiry conditions so that stale expectations do not survive into pricing or financing decisions.
Table 4. Incident and resilience matrix
| Event | Immediate action | Governance response |
|---|---|---|
| wrong output | stop affected workflow | reperform and assess consequence |
| data leakage | contain access and preserve evidence | notify and remediate |
| provider outage | invoke continuity route | test concentration and exit |
| control bypass | revoke authority | investigate cause and recurrence |
Replace illustrative classifications with company-specific evidence and approved transaction treatment.
Policy becomes effective only when inventory, testing, decisions, incidents, remediation and outcomes remain connected.
31. Prepare incident response
Wrong decisions, leakage, prompt attacks, service failures and harmful outputs need containment, notification, correction and learning.
Controlled evidence includes incident; detection; scope; consequence; containment; notification; cause; remediation. The immediate decision is to limit harm and prevent recurrence. Definitions should remain stable across investment, risk, committee, operational and financial records.
Investment, operations, finance, legal, compliance, technology, risk and investor-relations teams should use stable identifiers and definitions. Material outputs should be traced from source through transformation, review, approval, action and outcome.
The operating team and finance team should use the same definitions. Native records should support aggregate dashboards, and sample testing should follow representative cases from input through outcome and cash. Exceptions, failed cases and client concessions remain part of the population. Reconciliation should cover opening and closing balances, acquisitions, disposals, foreign exchange, allocation changes and manual adjustments that could otherwise mimic operating improvement.
32. Control model and system change
Provider releases, prompts, retrieval sources, policies, regulations and integrations can invalidate prior testing.
Controlled evidence includes baseline; change; trigger; impact; test; approval; deployment; monitoring. The immediate decision is to stop unapproved drift from changing outcomes. Definitions should remain stable across investment, risk, committee, operational and financial records.
Material risks include opaque models, weak data rights, misleading claims, conflicts, biased errors, control bypass, data leakage, vendor concentration, service failure and unowned remediation.
Decision makers need both upside and downside. The analysis should state which party controls conversion, what investment remains, when cash appears, which risks survive and whether the result continues after a change of ownership. Unsupported precision should be replaced with bounded scenarios. The committee should record the decision consequence of each range, including price, structure, funding, covenant, integration and monitoring implications.
33. Find and govern shadow AI
Unsanctioned accounts, browser tools, plugins and local models can process sensitive data outside inventory and control.
Controlled evidence includes tool; user; data; purpose; location; detection; risk; disposition. The immediate decision is to bring material hidden use into governed channels. Definitions should remain stable across investment, risk, committee, operational and financial records.
Governance evidence should remain entity-, fund-, strategy-, use-case-, decision-, provider-, jurisdiction- and period-specific. Reviews should preserve missing records, failed cases, overrides, exceptions, adverse outcomes and remediation evidence.
The analytical unit should remain stable from source record to valuation conclusion. Reviewers should see the population, exclusions, period, owner and reconciliation to finance. Where evidence is incomplete, the model should retain a range and identify the action needed to narrow it. Comparisons should preserve product, customer, site, complexity and market conditions; aggregation should not conceal adverse cohorts or delayed consequences.
34. Build role-specific competence
Boards, investment teams, operations, risk, compliance, legal and technology staff need training matched to their authority and exposure.
Controlled evidence includes role; decision; skill; module; assessment; gap; owner; refresh. The immediate decision is to equip people to challenge the systems they oversee. Definitions should remain stable across investment, risk, committee, operational and financial records.
The governing body should distinguish observation, automated output, professional judgment, approval and completed action. Each projected benefit needs full cost, accountable ownership and a route to collected fees, protected cash or sustained value.
Evidence should distinguish observation, estimate, management plan and transaction judgement. A supported claim includes timing, full cost, dependency, transferability and a cash consequence. Sensitivity should show how the conclusion changes when adoption, demand, quality or persistence underperforms. Material assumptions need validation dates, accountable owners and explicit expiry conditions so that stale expectations do not survive into pricing or financing decisions.
35. Create decision-useful management information
Management reporting should connect inventory, tier, testing, incidents, overrides, vendors, outcomes and overdue remediation.
Controlled evidence includes metric; population; period; owner; threshold; exception; action; closure. The immediate decision is to show governing bodies where exposure is changing. Definitions should remain stable across investment, risk, committee, operational and financial records.
Investment, operations, finance, legal, compliance, technology, risk and investor-relations teams should use stable identifiers and definitions. Material outputs should be traced from source through transformation, review, approval, action and outcome.
The operating team and finance team should use the same definitions. Native records should support aggregate dashboards, and sample testing should follow representative cases from input through outcome and cash. Exceptions, failed cases and client concessions remain part of the population. Reconciliation should cover opening and closing balances, acquisitions, disposals, foreign exchange, allocation changes and manual adjustments that could otherwise mimic operating improvement.
36. Establish independent assurance
Second-line review and internal or external audit should test design, operation, evidence and remediation using representative samples.
Controlled evidence includes scope; control; sample; test; finding; severity; owner; closure. The immediate decision is to challenge governance with independent evidence. Definitions should remain stable across investment, risk, committee, operational and financial records.
Material risks include opaque models, weak data rights, misleading claims, conflicts, biased errors, control bypass, data leakage, vendor concentration, service failure and unowned remediation.
Decision makers need both upside and downside. The analysis should state which party controls conversion, what investment remains, when cash appears, which risks survive and whether the result continues after a change of ownership. Unsupported precision should be replaced with bounded scenarios. The committee should record the decision consequence of each range, including price, structure, funding, covenant, integration and monitoring implications.
37. Build board and committee oversight
The governing body should approve risk appetite, material uses, exceptions and resources while tracking unresolved exposure and outcomes.
Controlled evidence includes committee; mandate; paper; decision; challenge; action; due date; evidence. The immediate decision is to make senior accountability demonstrable. Definitions should remain stable across investment, risk, committee, operational and financial records.
Governance evidence should remain entity-, fund-, strategy-, use-case-, decision-, provider-, jurisdiction- and period-specific. Reviews should preserve missing records, failed cases, overrides, exceptions, adverse outcomes and remediation evidence.
Reviewers should be able to retrieve each material source, transformation, exception, approval and retained record by fund, use case, obligation and period.
38. Measure governance economics
Controls, delays and assurance consume resources while preventing losses, protecting trust and enabling safe scale.
Controlled evidence includes cost; capacity; incident avoidance; service; revenue; cash; timing; owner. The immediate decision is to evaluate governance through full economics. Definitions should remain stable across investment, risk, committee, operational and financial records.
The governing body should distinguish observation, automated output, professional judgment, approval and completed action. Each projected benefit needs full cost, accountable ownership and a route to collected fees, protected cash or sustained value.
Evidence should separate facts, calculations, judgment and planned action. Each output needs a source, owner, period, cost, control and consequence. Tests should show how results change when volume, quality, timing or system performance weakens. Rules need review dates, owners and expiry conditions; stale logic should not govern records or payments.
39. Close findings and recurring weaknesses
Exceptions, incidents, audit findings and poor outcomes should enter one prioritised remediation system with durable root-cause fixes.
Controlled evidence includes finding; source; severity; cause; action; owner; due date; validation. The immediate decision is to turn governance evidence into completed remediation. Definitions should remain stable across investment, risk, committee, operational and financial records.
Investment, operations, finance, legal, compliance, technology, risk and investor-relations teams should use stable identifiers and definitions. Material outputs should be traced from source through transformation, review, approval, action and outcome.
The operating team and finance team should use the same definitions. Native records should support aggregate dashboards, and sample testing should follow representative cases from input through outcome and cash. Exceptions, failed cases and client concessions remain part of the population. Reconciliation should cover opening and closing balances, acquisitions, disposals, foreign exchange, allocation changes and manual adjustments that could otherwise mimic operating improvement.
Table 5. Evidence-gated implementation
| Period | Primary work | Gate |
|---|---|---|
| days 1-30 | inventory, mandate and risk tiers | approve baseline |
| days 31-60 | vendor, data and validation controls | approve bounded pilots |
| days 61-100 | oversight, assurance and outcomes | approve scaled use |
Replace illustrative classifications with company-specific evidence and approved transaction treatment.
Scale should follow inventory, authority, lineage, validation, resilience and measured outcomes.
40. Implement through evidence-gated cohorts
Begin with low-consequence retrieval and drafting before recommendations, records, instructions or execution.
Controlled evidence includes cohort; use case; owner; test; threshold; incident; benefit; gate. The immediate decision is to scale only after evidence, control and outcome gates pass. Definitions should remain stable across investment, risk, committee, operational and financial records.
Material risks include opaque models, weak data rights, misleading claims, conflicts, biased errors, control bypass, data leakage, vendor concentration, service failure and unowned remediation.
Decision makers need both upside and downside. The analysis should state which party controls conversion, what investment remains, when cash appears, which risks survive and whether the result continues after a change of ownership. Unsupported precision should be replaced with bounded scenarios. The committee should record the decision consequence of each range, including price, structure, funding, covenant, integration and monitoring implications.
References
- International Organization of Securities Commissions, Artificial Intelligence in Capital Markets: Use Cases, Risks, and Challenges, https://www.iosco.org/library/pubdocs/pdf/IOSCOPD788.pdf
- International Organization of Securities Commissions, Principles on Outsourcing, https://www.iosco.org/library/pubdocs/pdf/IOSCOPD687.pdf
- International Organization of Securities Commissions, Principles for Outsourcing in Financial Services, https://www.iosco.org/library/pubdocs/pdf/IOSCOPD443.pdf
- Financial Stability Board, The Financial Stability Implications of Artificial Intelligence, https://www.fsb.org/uploads/P14112024.pdf
- U.S. Securities and Exchange Commission, Artificial Intelligence and Investment Management, https://www.sec.gov/newsroom/speeches-statements/daly-020326-artificial-intelligence-future-investment-management
- U.S. Securities and Exchange Commission, Remarks at the Roundtable on Artificial Intelligence in the Financial Industry, https://www.sec.gov/newsroom/speeches-statements/crenshaw-remarks-ai-roundtable-032725
- U.S. Securities and Exchange Commission, Commission Interpretation Regarding Standard of Conduct for Investment Advisers, https://www.sec.gov/rules-regulations/2019/07/ia-5248
- U.S. Securities and Exchange Commission, Investment Adviser Recordkeeping Rule, https://www.ecfr.gov/current/title-17/chapter-II/part-275/section-275.204-2
- Financial Conduct Authority, Building Operational Resilience: Final Rules, https://www.fca.org.uk/publication/policy/ps21-3-operational-resilience.pdf
- Financial Conduct Authority, Senior Management Arrangements Systems and Controls Sourcebook, https://www.handbook.fca.org.uk/handbook/SYSC/
- Financial Conduct Authority, Artificial Intelligence and the FCA: Our Approach, https://www.fca.org.uk/firms/innovation/ai-approach
- Financial Conduct Authority, Frontier AI and Cyber Resilience, https://www.fca.org.uk/publications/multi-firm-reviews/frontier-ai-cyber-resilience
- European Securities and Markets Authority, Public Statement on Artificial Intelligence in Investment Services, https://www.esma.europa.eu/press-news/esma-news/esma-provides-guidance-firms-using-artificial-intelligence-investment-services
- European Securities and Markets Authority, Artificial Intelligence in EU Investment Funds, https://www.esma.europa.eu/sites/default/files/2025-02/ESMA50-43599798-9923_TRV_Article_Artificial_intelligence_in_EU_investment_funds.pdf
- European Union, Digital Operational Resilience Act, https://eur-lex.europa.eu/eli/reg/2022/2554/oj
- European Union, Alternative Investment Fund Managers Directive, https://eur-lex.europa.eu/eli/dir/2011/61/oj
- European Union, Regulation EU 2024/1689 Artificial Intelligence Act, https://eur-lex.europa.eu/eli/reg/2024/1689/oj
- European Union, Regulation EU 2016/679 General Data Protection Regulation, https://eur-lex.europa.eu/eli/reg/2016/679/oj
- National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework, https://www.nist.gov/itl/ai-risk-management-framework
- National Institute of Standards and Technology, Generative Artificial Intelligence Profile, https://doi.org/10.6028/NIST.AI.600-1
- International Organization for Standardization, ISO IEC 42001 Artificial Intelligence Management System, https://www.iso.org/standard/81230.html
- International Organization for Standardization, ISO IEC 27001 Information Security Management Systems, https://www.iso.org/standard/27001
- Organisation for Economic Co-operation and Development, OECD AI Principles, https://oecd.ai/en/ai-principles
- UK Information Commissioner's Office, AI and Data Protection Risk Toolkit, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/
- UK National Cyber Security Centre, Guidelines for Secure AI System Development, https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development
- Bank of England and Financial Conduct Authority, Artificial Intelligence in UK Financial Services, https://www.bankofengland.co.uk/report/2024/artificial-intelligence-in-uk-financial-services-2024
