ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) 14.2: Use algorithm-driven solutions safely: explainable decisions aligned to ethical norms and law, trained human-in-the-loop staff, defence against model attacks, disclosure to affected external parties, regular validation for accuracy and bias, drift review, and no weakening of existing controls

What does 14.2 require?

Where solutions support business decisions the framework ensures the institution can explain what data was used and the decision process behind an output, decision parameters align with its ethical norms, and no individual or group is systematically disadvantaged without justification, in compliance with applicable law. Staff in human-in-the-loop roles are trained for the solution and their role with escalation procedures; solutions exposed to external parties are regularly reviewed for compromise through model or data poisoning, extraction and denial of service; external parties whose data feeds decisions affecting them are told they are interacting with an algorithm-driven solution and given adequate information on its use, risks and limitations; developed models are regularly tested and validated for accuracy, performance, errors and unintended bias in decision points and input data and for adherence to the framework; models that drift beyond framework parameters are reviewed and recalibrated or retired; and use of such solutions never erodes existing controls; for example, access to sensitive data through the solution is granted only to users who hold the requisite rights.