This article is for informational purposes only and does not constitute financial or legal advice. You should consult with a qualified professional before making any decisions about the use of AI in your firm.
What Are the SM&CR Implications of Deploying AI in My Financial Services Firm?
SM&CR accountability does not disappear when a firm uses AI. Identify the senior manager and business owners responsible for the relevant activity, document the risks and controls, and keep evidence of review and challenge suited to the use case.
For an AI use case, start with the business decision rather than the model: what will the system do, who could be affected, and who can stop it? A credit assessment and an internal drafting assistant need different review questions. Set those questions before comparing suppliers or planning a rollout.
The Senior Manager's Burden: You Own the Black Box
Start by identifying the activity, the relevant responsibilities and the people who oversee it. Ask your compliance adviser to check the applicable SM&CR scope before assigning responsibility for the use case. Avoid treating an AI error as automatic proof of personal liability.
Do not rely on a vendor's assurance as your whole control record. Ask what evidence supports its explanation, which limitations remain and who will review them inside the firm. Build your review around a practical warning: a lack of understanding is not a defence. Ask the supplier to explain the system in terms your reviewers can use, and take unresolved questions about responsibilities to your compliance adviser.
| SM&CR Principle |
How AI Magnifies the Risk |
| Duty of Responsibility |
Have the responsible reviewer establish the relevant responsibility allocation and applicable duties for the AI-supported activity. Keep the decision, evidence considered and follow-up actions with that assessment. |
| Prescribed Responsibilities |
If you hold a prescribed responsibility for, say, risk management or compliance, you are responsible for how AI impacts those areas. |
| Overall Responsibility |
Even if AI is not explicitly in your job description, the "overall responsibility" requirement means that if it is used in your business area, you are accountable. |
The "Explainability" Paradox
Some AI outputs can be difficult to explain in terms a reviewer can use. For your proposed workflow, record what explanation is available, what it leaves unanswered and how that affects the decision to use the system. Do not assume that a technical description alone establishes an adequate control.
For example, if an output contributes to declining a credit application, ask the team to walk through the data, the review and the route for questioning the result. An unanswered question should remain visible in the decision record rather than disappear behind a model score.
Do not treat an explanation gap as a universal legal test. Ask which explanation is needed for the decision and whether the proposed controls address the remaining uncertainty. Take unresolved gaps to the responsible reviewer and obtain advice before deciding whether to approve, restrict or stop the use.
A Framework for Demonstrating "Reasonable Steps"
Use the checklist below to prepare a review with your compliance and risk teams, not to certify that reasonable steps have been taken. For each item, record the owner, evidence, unresolved issue and next decision. The table and checklist are starting points for discussion; ask your adviser which points apply to the proposed activity.
Work through these questions against one named AI use case. If an item is not relevant, record why rather than silently omitting it:
- Clear accountability: review the firm's actual governance map and responsibility statements for the activity using AI. Ask the responsible professional whether updates are needed and record the confirmed allocation, without assuming a new AI-specific prescribed responsibility.
- Supplier review: agree the evidence needed for the intended activity, including the product, data, model limits and security controls. Have the responsible reviewer determine which gaps prevent approval.
- Oversight: identify reviewers with the authority, evidence and capacity to challenge or stop the work. Test whether they can use that route in the proposed workflow.
- Comprehensive Training: You and your team need to be trained on the risks of AI. You need to understand the potential for bias, the importance of data quality, and the limitations of the technology.
- Transparent Record-Keeping: You need to be able to show your working. This means documenting your risk assessments, your due diligence, your training programs, and your monitoring of the AI system's performance.
The Bottom Line: SM&CR Demands Active Governance
Bring the review back to the named activity: who decides whether the use can proceed, who monitors it and what would trigger another review? Keep those decisions with the evidence used to make them, including any unresolved supplier or model limitations.
You can no longer afford to be a passive observer of your firm's AI strategy. You need to be an active, engaged, and critical participant. You need to ask the tough questions, challenge the assumptions, and demand the evidence. Bring the supplier's answers and the team's testing records to the review meeting. Assign an owner and a follow-up date to each open question.
Your career depends on it. Keep a review file you can return to: the decision, the evidence considered, the questions raised and the actions agreed. Use it at the next review to check what has changed and what still needs attention.
Take the Next Step
If you need help organising the review, the AI Audit can provide a starting point for discussing the use cases, evidence gaps and decisions to take to your team. Agree its scope first; an operational assessment is not legal advice or confirmation that a regulatory requirement has been met.
Book a Discovery Call → or learn more about the AI Audit.
Need help assessing an AI workflow and its unresolved risks?
Start by mapping the intended decisions, service workflows and data involved. Use that map to identify questions about Consumer Duty, SM&CR and model risk for qualified review, rather than assuming that an AI opportunity assessment resolves them.
