A governing framework ensures all algorithm-driven solutions, including machine learning, artificial intelligence and generative AI models, whether built or sourced, follow defined principles, sit within the risk framework and the appetite set for model behaviour, and obey system development policies, covering development, use, monitoring, maintenance and cessation, reviewed regularly and approved by senior management and the Governing Body. A materiality classification by model complexity and outcome impact (customer, regulatory, financial) holds more material solutions to higher design standards and stricter controls; competent staff with business expertise design the framework and develop, acquire and manage solutions; each solution has an accountable senior executive; desired objectives and expected outcomes are defined with processes or tools that catch and correct wrong or unwanted outputs. Internally developed solutions follow secure development practices, are approved by management, undergo robust functional and non-functional testing, are trained on data of appropriate quality and quantity, and have updates developed and tested under the framework; sourced solutions meet the framework, receive due diligence on model design and have vendor updates reviewed and tested before deployment; and where staff may use public algorithm-driven tools like end-user computing, acceptable use policies set permitted and prohibited scenarios, data handling and violation reporting.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.