This article is for informational purposes only and does not constitute financial or legal advice. You should consult with a qualified professional before making any decisions about the use of AI in your firm.
How Can I Demonstrate "Understanding" of AI Systems Under SM&CR?
A senior manager overseeing an AI-supported process should be able to explain its purpose, risks, controls and review arrangements. Keep a record of questions asked, evidence reviewed and decisions made, and check which SM&CR responsibilities apply to the role.
Focus the review on the system's purpose, limitations, risks and controls. Ask the relevant technical specialists to explain how it works, and record any questions you cannot yet answer. Check the applicable supervisory requirements for your role separately.
Review the evidence behind the vendor's explanation, including testing and known limitations.
The Three Levels of AI Understanding for a Senior Manager
Use the following three-part framework to organise questions about the system. It is not a test of whether you have met your SM&CR responsibilities:
| Level |
Description |
Key Questions to Ask |
| 1. Conceptual Understanding |
You need to understand what the AI is supposed to do, what type of AI it is (e.g., machine learning, generative AI), and the fundamental principles of how it works. |
What business problem does this AI solve? What are the inputs and what are the outputs? Is it a probabilistic or deterministic system? What are the known limitations of this type of AI? |
| 2. Risk-Based Understanding |
You need to understand the specific risks the AI system introduces to your business area. This is the most critical level for SM&CR purposes. |
What is the risk of this AI producing biased or discriminatory outcomes? How could this AI be manipulated by malicious actors? What is the operational risk if this AI fails? What is the data privacy risk? How does this AI impact our compliance with the Consumer Duty? |
| 3. Governance Understanding |
You need to understand the controls, oversight, and accountability mechanisms that are in place to manage the risks you have identified. |
Who is responsible for the ongoing monitoring of this AI? What is our process for validating its outputs? What training have our people received? What is our incident response plan if this AI causes harm? What does our contract with the vendor say about liability? |
Moving from Passive to Active Understanding
Use vendor documentation and your team's explanation as the starting point for review. Ask which evidence supports the proposed use, which limitations matter and which questions remain unresolved.
Challenge assumptions that affect the proposed workflow. Ask your team and vendor to explain the testing, review arrangements and response if the tool produces an unreliable result.
Here is a practical example. Your firm is proposing to use an AI tool to help with investment recommendations:
- Passive understanding: "The IT team says the AI will help us make better investment decisions."
- Active understanding: "The AI uses a machine learning model trained on historical market data. I want to know what steps have been taken to ensure the model is not overfitting to past performance. I want to see the results of the bias testing. I want to understand the scenarios in which the model is known to be unreliable. I want to know who is responsible for signing off on the recommendations before they go to the client."
Documenting Your Understanding: The Defensibility Trail
Keep records of the questions, evidence and decisions in your review. Check which records and responsibilities apply to your role and the process you oversee.
This includes:
- Minutes of meetings where you have challenged your team and your vendors on the risks of the AI system.
- Your own notes from those meetings, demonstrating your engagement with the issues.
- Emails where you have sought clarification on technical points.
- Your sign-off on the AI risk assessment, with comments and annotations.
These records can explain what you reviewed and decided. They do not, by themselves, establish that you have met the applicable duty of responsibility.
The Bottom Line: Understanding is an Action, Not a State
Explain the AI-supported process, its limitations and the controls you oversee. Record the questions that need further technical or compliance review.
Record the evidence you challenged, decisions made and actions still open.
Resolve unanswered questions before relying on the system for the proposed work, and seek advice on the responsibilities that apply to your role.
Take the Next Step
For an AI Audit discussion, identify the AI-supported process, the manager responsible, the evidence already reviewed and the oversight questions still open.
Book a Discovery Call → or learn more about the AI Audit.
Need help assessing an AI workflow and its unresolved risks?
Map the AI-supported process, accountable manager, model and client-data controls, and evidence still needed. Check which Consumer Duty and SM&CR responsibilities apply before approving the use.
