US Treasury publishes AI risk Guidebook for financial institutions

The US Treasury has published a Guidebook for financial institutions to manage AI risks, developed by a collaboration among over 100 financial institutions and industry organizations. The CRI Financial Services AI Risk Management Framework (FS AI RMF) aims to help financial institutions identify, evaluate, manage, and govern the risks associated with AI systems. The framework contains four main components: an AI adoption stage questionnaire, a risk and control matrix, a control objective reference guide, and a set of 230 control objectives organized according to four functions: govern, map, measure, and manage.

The adoption stage questionnaire determines the extent to which an organization is using AI, evaluating factors like business impact, governance arrangements, deployment models, use of third-party AI providers, organizational objectives, and data sensitivity. Based on this assessment, organizations are classified into four stages of AI adoption: initial stage, minimal stage, evolving stage, and advanced stage.

The Guidebook explains how firms can assess their current AI maturity and implement controls to limit their risk. Its aim is to promote consistent and responsible AI practices and support innovation in the sector. The FS AI RMF is being positioned as an extension to the NIST AI Risk Management Framework, with additional sector-specific controls and practical implementation guidelines.

The framework defines a total of 230 control objectives organized according to four functions adapted from the broader NIST AI Risk Management Framework: govern, map, measure, and manage. Each function contains categories and subcategories that describe elements of effective AI risk management and governance.

The Guidebook is designed to help financial institutions manage AI risks and promote responsible AI practices. It provides a structured approach to managing AI risks in operations and policy, and is intended to support innovation in the sector while ensuring that firms continue to adopt AI technologies responsibly.