A large Canadian bank recognized the growing importance—and risk—of integrating large language models (LLMs) into their business processes. While innovation teams had begun experimenting with AI capabilities, there was no centralized framework to manage AI use cases, track model deployments, or ensure compliance with regulatory expectations.
The organization faced several immediate challenges:
- Uncertainty about how to govern LLMs within existing risk and compliance programs.
- Pressure to align with evolving regulatory frameworks, including OSFI's expectations and international standards.
- Lack of a centralized repository to track AI use cases, models, and assessments.
- A gap in awareness across teams on how to document, evaluate, and communicate AI risks.
Our Solution
SureStep was engaged to define and operationalize an AI governance structure that could scale with the bank’s AI ambitions. Our work included:
- Helping the client evaluate and select a regulatory-aligned AI risk framework. After comparison and gap analysis, the bank adopted the NIST AI Risk Management Framework (AI RMF) as their foundational model.
- Designing a custom assessment process tailored to the bank’s use of LLMs, covering impact, explainability, fairness, privacy, and model oversight.
- Enabling responsible adoption by developing training materials, internal communications, and facilitation guides to help business and risk teams speak a common language around AI governance.
- Extending the client’s existing GRC platform to house AI governance data, including: AI use case records and ownership, LLM model documentation and lifecycle tracking, and Risk assessment artifacts mapped to the NIST AI RMF.
- Integrating the new AI assessments into existing governance processes—ensuring traceability from AI model development through deployment and ongoing monitoring.
Results Achieved
- A structured, repeatable approach to AI governance anchored in a globally recognized framework.
- Clear traceability of LLM-related risk across business units, enabling compliance with OSFI expectations and upcoming global standards.
- Enhanced understanding across business, risk, and technology teams, with a shared governance model to guide future AI initiatives.
- A fully integrated AI governance registry within the GRC platform, ensuring oversight and auditability of AI activities.
.webp)
-1.jpg)
.jpg)
.jpeg)
