AI Governance and Risk Management for Financial Regulators Training Workshop

Course overview

The AI Governance, Banking Technology Risk and Third-Party Risk Management for Financial Regulators Training Workshop equips central bank officials, financial regulators and supervisory professionals with practical frameworks for assessing emerging technology risks across banks and other regulated financial institutions. The programme addresses the growing adoption of artificial intelligence, generative AI, cloud computing, fintech platforms, outsourced technology services and external data providers, all of which introduce new governance, operational, cybersecurity and financial stability considerations.

Participants explore how to assess institutional AI governance, model risk management, algorithmic accountability, technology infrastructure, critical outsourcing arrangements, cloud service dependencies, vendor concentration and operational resilience. The workshop examines the responsibilities of boards and senior management, regulatory expectations for third-party risk management, contractual safeguards, supervisory access rights, incident reporting, business continuity and exit planning.

Course objectives

• Evaluate AI governance frameworks, model risk controls and responsible AI practices within regulated financial institutions.
• Develop supervisory examination plans, technology risk assessment reports, remediation frameworks and ongoing monitoring mechanisms.
• Apply supervisory tools to identify AI-related risks, vendor concentration, data protection weaknesses and material operational vulnerabilities.
• Conduct risk-based assessments of third-party providers, outsourcing contracts, cloud services and critical technology dependencies.
• Assess enterprise technology risks, cybersecurity vulnerabilities and operational resilience arrangements across banking systems.

Who should attend

Course content

• Module 1. Foundations of AI Governance and Technology Risk Supervision AI adoption in financial services, emerging technology risk categories, supervisory responsibilities, technology-enabled banking business models, AI governance principles, operational
• Module 2. Regulatory Frameworks and International Supervisory Standards International AI governance principles, Basel operational resilience principles, third-party risk management guidance, outsourcing requirements, cybersecurity frameworks, data protec
• Module 3. AI Governance, Model Risk and Responsible AI Oversight AI governance policies, board and executive accountability, AI inventories, use-case classification, model development and procurement, independent validation, model performance monitoring,
• Module 4. Generative AI, AI Agents and Emerging Technology Risks Generative AI in banking, large language models, retrieval-augmented generation, automated decision-making, AI agents, external foundation models, hallucinations, prompt injection, sensitiv
• Module 5. Enterprise Technology Risk Management and IT Governance Enterprise IT risk frameworks, technology risk appetite, IT governance structures, risk ownership, technology asset inventories, critical system identification, application and infrastruct
• Module 6. Cybersecurity, Data Protection and Information Security Cybersecurity risk assessment, identity and privileged access management, encryption, data classification, secure software development, vulnerability management, API security, software sup
• Module 7. Third-Party Risk Management and Vendor Due Diligence Third-party risk governance, vendor identification and classification, due diligence procedures, financial and operational viability, security assessments, regulatory compliance checks, reput
• Module 8. Cloud Outsourcing, SaaS and Technology Service Providers Cloud service models, public and private cloud, hybrid and multi-cloud environments, infrastructure and platform services, SaaS dependencies, cloud migration risk, shared responsibility m
• Module 9. Outsourcing Contracts, Service-Level Agreements and Regulatory Access Contractual risk allocation, service-level agreements, confidentiality obligations, data ownership, subcontracting provisions, audit rights, regulatory access and information
• Module 10. Fourth-Party Dependencies and Technology Concentration Risk Subcontracting and fourth-party relationships, interconnected service providers, common cloud infrastructure, shared AI foundation models, common cybersecurity vendors, supply-chain d
• Module 11. Operational Resilience, Business Continuity and Disaster Recovery Critical business services, impact tolerances, business impact analysis, recovery time and recovery point objectives, business continuity planning, disaster recovery, cloud outa
• Module 12. AI and Technology Incident Management Technology incident classification, AI model failures, erroneous automated decisions, data breaches, cloud service disruptions, vendor security incidents, root-cause analysis, incident escalation, regulato
• Module 13. Supervisory Examinations, Risk Assessment and Regulatory Intervention Risk-based examination planning, AI governance reviews, technology control assessments, vendor due diligence reviews, outsourcing contract examinations, cybersecurity eviden
• Module 14. Enterprise Risk Platforms, AI Assurance and Supervisory Monitoring Enterprise governance, risk and compliance platforms, third-party risk management systems, AI governance platforms, model risk registers, automated vendor assessments, technolo
• Module 15. Integrated Capstone: Supervisory Assessment of AI and Technology Outsourcing Assessment of a simulated bank deploying an AI-based credit assessment system hosted by an external cloud provider, classification of critical services, evaluation of

General notes

• Practical Exercises and Case Studies Assess an AI governance framework and identify gaps in accountability, independent validation and human oversight. Evaluate an AI-based credit scoring system for model risk, bias, explainability and customer impact. Conduct a technology risk assessment for a simulated bank's core banking and digital payment infrastructure. Complete a vendor due diligence assessment for a cloud-hosted banking application. Review an outsourcing contract for audit rights, regulatory access, data protection, subcontracting and termination provisions. Map fourth-party dependencies and evaluate concentration exposure to a common cloud or AI provider. Assess cybersecurity and privacy risks associated with a generative AI assistant used by bank employees. Evaluate a business continuity plan following a prolonged cloud service outage. Develop a risk-based supervisory examination plan for a financial institution with extensive AI and technology outsourcing. Prepare a supervisory dashboard specification covering AI governance, third-party exposure, technology incidents and remediation. Draft supervisory findings and corrective actions for identified AI, cybersecurity and outsourcing control weaknesses. Complete an integrated technology risk supervision report with prioritised recommendations.
• Critical Enterprise Tools and Platforms ServiceNow Integrated Risk Management (IRM), Archer, MetricStream, ServiceNow Third-Party Risk Management, OneTrust, ProcessUnity, IBM watsonx.governance, ModelOp, Credo AI, Microsoft Defender for Cloud, AWS Security Hub, Microsoft Sentinel, Splunk Enterprise Security, Microsoft Entra ID, CyberArk, HashiCorp Vault, BitSight, SecurityScorecard, LeanIX, enterprise configuration management databases (CMDBs), NIST AI Risk Management Framework, ISO/IEC 42001, ISO/IEC 27001 and ISO 22301.
• The workshop should prioritise enterprise risk platforms, AI governance solutions, vendor-risk tools, cloud security controls and technology dependency mapping. Specific products can be selected according to institutional licensing, procurement policies, deployment architecture and data confidentiality requirements.
• Practical Outputs and Deliverables AI governance assessment framework, AI system inventory and risk classification matrix, AI model risk assessment checklist, responsible AI oversight framework, enterprise technology risk register, IT control assessment matrix, cybersecurity risk assessment checklist, third-party risk management framework, outsourcing register and critical service classification matrix, vendor due diligence questionnaire, outsourcing contract review checklist, cloud and AI provider concentration assessment, fourth-party dependency register, operational resilience assessment framework, business continuity and disaster recovery review checklist, technology incident assessment template, supervisory examination plan, AI and technology risk dashboard specification, supervisory findings and remediation tracking matrix, integrated supervisory risk assessment report.

Frequently asked questions

Schedule & fees