CT Issues Guidance on AI Systems Governance

The Connecticut Department of Banking issued regulatory guidance regarding the governance of AI systems for financial institutions and entities licensed or regulated by the state.

The guidance applies to both consumer-facing and internal AI systems.  In developing AI governance, regulated entities must consider the size and activities of the entity and the scope, complexity, risk, and data sensitivity of the AI systems.  In turn, the AI governance framework must be sent forth in a written AI governance plan which:

• Vests responsibility for the development, implementation, and monitoring of AI systems with senior management who are accountable to a board of directors or other governing body;
• Ensures cybersecurity, privacy, and protection of consumer information;
• Considers and incorporates industry best practices and standards;
• Covers the full lifecycle of AI systems (e.g., development and acquisition; testing and validation; deployment; monitoring; change management; retirement or decommissioning);
• Inventories AI systems;
• Assesses applicable risks and risk-management practices;
• Ensures AI systems comply with applicable laws;
• Defines human oversight of AI systems;
• Requires training for board members, senior management, and relevant personnel;
• Manages risks related to third-party vendors who offer or support AI systems; and
• Provides for appropriate documentation of activity related to AI systems and compliance with the governance plan.

The state indicated that it will review AI systems, governance frameworks, and related policies and procedures as part of supervisory activities.  Likewise, AI systems should be transparent and explainable, including with respect to how AI systems affect consumers.