Every AI use case gets a risk materiality rating under one methodology, built around the FI's business and the risks of the systems and models involved, including dependencies between AI systems that could change the overall risk, and applied consistently so that the more material use cases attract closer scrutiny and stronger controls and stay inside their approved boundaries. The rating is assessed twice: inherent materiality before controls and residual materiality after them, and residual materiality must fit the FI's risk appetite before deployment; both the methodology and the individual ratings are reviewed regularly to stay relevant. Three dimensions are the minimum: impact, meaning what a failure, malfunction or poor performance would do to the FI (financially, operationally, in regulatory or reputational terms) and to customers and stakeholders (fairness, ethics, consumer protection), with the nature and sensitivity of the data processed taken into account; complexity, arising from the technology, the novelty of its application, the data it relies on and how explainable its outputs are, a dimension that can shift as understanding matures, and for third-party AI how much the FI can see of the technology and the data; and reliance, meaning how far the decision or output depends on the AI (third-party AI included), how much autonomy it has and how much human involvement or oversight sits in the process. A designated control function sets the assessment framework, arbitrates or approves each rating, keeps independent oversight of consistent application, and ensures the ratings are documented and reviewed regularly for accuracy and relevance.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.