Defensible AI Library

OSFI Guideline E-23

Where the client stands against OSFI E-23, the gaps, and each requirement traced to an artifact.

• E-23 twelve-question checkWhere the client stands on six themes, as a position.

  Used by

  Compliance lead, CRO

  Fills from

  Register

  Sign up to open this document: E-23 twelve-question check
• Scope self-checkWhich systems E-23 reaches.

  Used by

  Compliance lead, CRO

  Fills from

  Register

  Sign up to open this document: Scope self-check
• Gate record, G1 to G5One record per gate, one named approver.

  Used by

  Compliance lead, CRO

  Fills from

  Gate states

  Sign up to open this document: Gate record, G1 to G5
• BOE DeclarationThe declaration made for each system in scope.

  Used by

  Compliance lead, CRO

  Fills from

  Register

  Sign up to open this document: BOE Declaration
• Engineering review questions PEVG and PARAThe review questions asked of each system.

  Used by

  Compliance lead, CRO

  Fills from

  Register

  Sign up to open this document: Engineering review questions
• Vendor assessmentThe AVRF questionnaire, set to E-23.

  Used by

  Compliance lead, CRO

  Signed by

  CRO, at the institution

  Fills from

  Vendor records

  Sign up to open this document: Vendor assessment
• Trigger registerEvents that re-open a system before its date.

  Used by

  Compliance lead, CRO

  Fills from

  Register, incidents

  Sign up to open this document: Trigger register
• Gap planFrom the check's gaps to owners and dates.

  Used by

  Compliance lead, CRO

  Signed by

  Compliance lead, at the institution

  Fills from

  The twelve-question check

  Sign up to open this document: Gap plan
• Traceability binderEach E-23 requirement traced to this client's artifact.

  Used by

  Compliance lead, Internal audit

  Signed by

  Compliance lead, at the institution

  Fills from

  Every E-23 document

  Sign up to open this document: Traceability binder

CADRE™, the AI Governance Operating Model

The charter, who decides what, the meeting records and the escalation paths.

• Governance charter and decision rights CADREMandate, scope, one accountable person per decision type.

  Used by

  CRO, Compliance lead

  Signed by

  CRO, at the institution

  Fills from

  Register owners

  Sign up to open this document: Governance charter and decision rights
• Operating rhythm recordsWeekly operations, monthly risk, quarterly board, annual refresh.

  Used by

  CRO, Compliance lead

  Fills from

  Meeting records

  Sign up to open this document: Operating rhythm records
• Escalation pathsIncidents, human-review tiers and gate disputes.

  Used by

  CRO, Compliance lead

  Signed by

  CRO, at the institution

  Fills from

  Charter

  Sign up to open this document: Escalation paths
• AI acceptable use policyWhat staff may and may not do with AI tools.

  Used by

  CRO, Compliance lead, CISO

  Fills from

  Your answers

  Sign up to open this document: AI acceptable use policy
• Role descriptionsThe office's named roles.

  Used by

  CRO, Compliance lead

  Fills from

  Your answers

  Sign up to open this document: Role descriptions
• Office launch checklistStanding the office up.

  Used by

  CRO, Compliance lead

  Fills from

  Your answers

  Sign up to open this document: Office launch checklist
• First 90 days planThe first quarter's milestones.

  Used by

  CRO, Compliance lead

  Fills from

  Your answers

  Sign up to open this document: First 90 days plan
• Exception request and registerTime-boxed relief from a policy clause, with its controls.

  Used by

  CRO, Compliance lead

  Fills from

  Your answers

  Sign up to open this document: Exception request and register
• Committee charters and agendasEthics committee, validation forum and their agendas.

  Used by

  CRO, Compliance lead

  Fills from

  Your answers

  Sign up to open this document: Committee charters and agendas

AI Data Governance Framework™ and MESA MRM Framework™

Who a system affects and how, what it is built from, and where its data comes from.

• AI impact assessmentWho is affected, how, and what controls it.

  Used by

  Model owner, Data lead, Compliance lead

  Signed by

  Model owner, at the institution

  Fills from

  Register

  Sign up to open this document: AI impact assessment
• Data governance viewData classes, lineage and residency, by system.

  Used by

  Data lead

  Signed by

  Data lead, at the institution

  Fills from

  Register

  Sign up to open this document: Data governance view
• Model cardWhat a model is for, and not for.

  Used by

  Model owner, Data lead, Compliance lead

  Fills from

  Register

  Sign up to open this document: Model card
• AI bill of materialsModels, adapters, knowledge sources and tools.

  Used by

  Model owner, Data lead, Compliance lead

  Fills from

  Register, vendor records

  Sign up to open this document: AI bill of materials
• Data protection impact assessmentPersonal information in the system.

  Used by

  Model owner, Data lead, Compliance lead

  Fills from

  Your answers

  Sign up to open this document: Data protection impact assessment
• Data lineageWhere each input comes from.

  Used by

  Model owner, Data lead, Compliance lead

  Fills from

  Your answers

  Sign up to open this document: Data lineage
• Data catalog specificationWhat each dataset holds.

  Used by

  Model owner, Data lead, Compliance lead

  Fills from

  Your answers

  Sign up to open this document: Data catalog specification
• Policies: development, data, retention, anonymizationThe policies a system is built under.

  Used by

  Model owner, Data lead, Compliance lead

  Fills from

  Your answers

  Sign up to open this document: Policies: development, data, retention, anonymization

Five-Gate Deployment Model™ and MESA MRM Framework™

Everything a gate needs, in one pack, and the validation behind it.

• Deployment gate review pack Five-GateThe gate's checklist, artifacts and record draft.

  Used by

  Model owner, Validator, CRO

  Signed by

  Model owner, at the institution

  Fills from

  Register, files

  Sign up to open this document: Deployment gate review pack
• Validation reportValidation, its unexamined set and dissent.

  Used by

  Validator, Model owner

  Signed by

  Validator, at the institution

  Fills from

  Register

  Sign up to open this document: Validation report
• Bias audit reportTests by group, before the gate.

  Used by

  Validator, Model owner

  Fills from

  Your answers

  Sign up to open this document: Bias audit report
• Drift monitoring configurationWhat is watched after release, and the thresholds.

  Used by

  Model owner, Validator, CRO

  Fills from

  Your answers

  Sign up to open this document: Drift monitoring configuration
• Model retirement checklistClosing a system down.

  Used by

  Model owner, Validator, CRO

  Fills from

  Register

  Sign up to open this document: Model retirement checklist

AVRF™ and Cross-Border AI Architecture Patterns™

The questionnaire out, the answers in, findings, conditions and a named decision.

• AI vendor assessment AVRFIssue, collect, findings and a named decision.

  Used by

  Procurement lead, CISO, Compliance lead

  Signed by

  CRO, at the institution

  Fills from

  Vendor records

  Sign up to open this document: AI vendor assessment
• Vendor due diligence questionnaireA ten-section questionnaire for AI vendors.

  Used by

  Procurement lead, CISO, Compliance lead

  Fills from

  Your answers

  Sign up to open this document: Vendor due diligence questionnaire
• RFP for AI vendorsAsking vendors the right questions up front.

  Used by

  Procurement lead, CISO, Compliance lead

  Fills from

  Your answers

  Sign up to open this document: RFP for AI vendors
• AI contract clausesThe clauses AI contracts need.

  Used by

  Procurement lead, CISO, Compliance lead

  Fills from

  Your answers

  Sign up to open this document: AI contract clauses
• Vendor comparisonVendors side by side, in words.

  Used by

  Procurement lead, CISO, Compliance lead

  Fills from

  Vendor records

  Sign up to open this document: Vendor comparison
• Vendor management policyHow vendors are chosen and kept.

  Used by

  Procurement lead, CISO, Compliance lead

  Fills from

  Your answers

  Sign up to open this document: Vendor management policy
• Transfer risk registerData that crosses a border, and on what basis.

  Used by

  Procurement lead, CISO, Compliance lead

  Fills from

  Your answers

  Sign up to open this document: Transfer risk register

AIRP™, the AI Incident Response Protocol

From the first signal to the review, with every notice drafted.

• AI incident pack AIRPTimeline, reconstruction and the review.

  Used by

  CISO, CRO

  Signed by

  CRO, at the institution

  Fills from

  Incident log

  Sign up to open this document: AI incident pack
• Severity classification guide, P0 to P4How bad, and how fast.

  Used by

  CISO, CRO

  Fills from

  Your answers

  Sign up to open this document: Severity classification guide, P0 to P4
• Runbook: bias detected in productionThe first hours, step by step.

  Used by

  CISO, CRO

  Fills from

  Your answers

  Sign up to open this document: Runbook: bias detected in production
• Post-incident reviewWhat happened, why, and what changes.

  Used by

  CISO, CRO

  Fills from

  Incident log

  Sign up to open this document: Post-incident review
• Notices: internal, regulator, customer, mediaEvery notice an incident may need.

  Used by

  CISO, CRO

  Fills from

  Incident log

  Sign up to open this document: Notices: internal, regulator, customer, media

SACF™, the Sharia AI Compliance Framework

Technical validation and Sharia review, run as two tracks and closed together.

• Sharia dual validation SACFBoth tracks, prepared for the bank's own sign-off.

  Used by

  Sharia board liaison, Validator

  Signed by

  Sharia board liaison, at the institution

  Fills from

  Register

  Sign up to open this document: Sharia dual validation
• Halal data certification checklistData sourcing checked against Sharia principles.

  Used by

  Sharia board liaison, Validator

  Fills from

  Your answers

  Sign up to open this document: Halal data certification checklist
• Sharia data review checklistThe Sharia board's review of data use.

  Used by

  Sharia board liaison, Validator

  Fills from

  Your answers

  Sign up to open this document: Sharia data review checklist

MESA Framework™

The position, the board's quarterly briefing, the mapping and the audit trail.

• Maturity position report MESAWhere the client stands on four altitudes, in words.

  Used by

  CRO, Compliance lead, Internal audit

  Signed by

  CRO, at the institution

  Fills from

  Readiness

  Sign up to open this document: Maturity position report
• Board briefingCounts, what changed, the decisions asked.

  Used by

  CRO

  Signed by

  CRO, at the institution

  Fills from

  Register, incidents

  Sign up to open this document: Board briefing
• Regulatory mapping matrixEach control against the rows it answers.

  Used by

  CRO, Compliance lead, Internal audit

  Fills from

  Regulation rows

  Sign up to open this document: Regulatory mapping matrix
• Audit evidence checklistWhat an auditor will ask to see, and where it is.

  Used by

  Internal audit

  Fills from

  Register, files

  Sign up to open this document: Audit evidence checklist
• Examiner binderThe traceability binder, ready for an examiner.

  Used by

  Compliance lead, Internal audit

  Signed by

  Compliance lead, at the institution

  Fills from

  Every kit

  Sign up to open this document: Examiner binder