Senior management's duties: put the AI risk frameworks, structures, policies and procedures into effect across the FI in line with risk appetite; test their effectiveness regularly and revise them as AI, the FI's risk profile and strategy, and regulation change; set strategies and controls that span the whole AI life cycle; fix who is responsible for AI risk across business lines and functions, including the control functions that own AI identification, inventory and materiality assessment (a three-lines model is one option, with developers and users in the first line, independent challenge and validation in the second and internal audit assuring the framework); run an internal escalation route for material AI risks and exceptions, such as AI incidents (failures, malfunctions or poor performance of an AI system or model) or breaches of risk thresholds, so that action follows promptly; brief the board on material AI risk matters without delay; and secure competent people and enough human, technological and financial resources, with training and capacity building.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.