AI governance and supervision for regulators

Supervising AI is not the same as running it. A supervisor's job is to judge whether a firm's AI risk management is adequate for what the firm is actually doing, not to validate its models or write its policies. I supervised AI at the Monetary Authority of Singapore, led the thematic review behind the 2024 Information Paper, and wrote the AIRG. I now teach regulators and supervisors, including as a module lead for the Cambridge Centre for Alternative Finance. This is how I think about it from the supervisor's seat, written up as a short book and laid out below.

Start here

If you read one thing, read the five questions a supervisor should ask about AI. They are the whole book in miniature, drawn from the AIRG's oversight areas but read from the outside.

The supervisor's frame

• How regulators assess AI - you assess the management of the model, not the model; ask for evidence you can interrogate, not a demo.
• Where firms hide AI risk - the low rating, the inventory gap, and oversight on paper. Where to point your scrutiny first.
• Proportionality in AI supervision - the tool that lets you supervise an estate you could never inspect in full, and how firms misuse it.

The areas you assess, in detail

• AI oversight and accountability - one consistent approach across the firm, and accountability that holds the levers, not a title.
• The AI inventory and the materiality rating - the two things everything else hangs off. The heart of the book.
• Assessing AI controls before deployment - data, testing, fairness, and the independent validation gate.
• Monitoring AI after deployment - human oversight, drift, and why a retrain is a new model.
• Supervising third-party AI - most AI is bought, not built. Compensatory testing and concentration risk.
• Building AI supervisory capability - what your team needs to understand, and guidance for emerging-market supervisors.

The working reference

The AI supervision assessment checklist condenses the book into the areas to assess, what to look for in each, and the one question to put to a firm. For how the main frameworks line up, see the AIRG compared to the EU AI Act, NIST, and ISO 42001.

You do not need to invent a framework

Strip the packaging off the main frameworks and they converge on the same areas: inventory, materiality, oversight, lifecycle controls, capability. Take a current one with standing in your market, read it against the law you already enforce, and adapt it to your mandate. For a supervisor in an emerging market, build on the risk-based supervision you already run, lean on proportionality so a small team can cover a large estate, and pay particular attention to how firms manage third-party AI, because most of the AI they use they did not build.

Frequently asked questions

How do regulators assess a firm's AI risk management?

A supervisor judges whether a firm's AI risk management is adequate for what the firm is actually doing, rather than validating its models or writing its policies. You assess the management of the model, not the model, and you ask for evidence you can interrogate, not a demo.

What should a supervisor look at first?

The three places firms hide risk: the low materiality rating, the inventory gap, and oversight that exists only on paper. Point your scrutiny there before the showcase systems.

What is proportionality in AI supervision?

Proportionality is the supervisor's tool, not the firm's loophole: match your scrutiny to materiality so you can supervise an estate you could never inspect in full. Firms sometimes misuse the word to argue for less, which is what you watch for.

Do supervisors need to understand the models to supervise AI?

No. You assess the management of the model, not the model itself. The job is to read the evidence a firm can show you - the inventory, the materiality rating, the independent validation, the monitoring - not to rebuild it or read its weights.

How can a supervisor build an AI regime from scratch?

You do not need to invent a framework. Take a current one with standing in your market, read it against the law you already enforce, and adapt it to your mandate. Build on the risk-based supervision you already run, lean on proportionality so a small team can cover a large estate, and pay particular attention to how firms manage third-party AI, because most of the AI they use they did not build.

Work with me

I train regulators, supervisors, and public authorities on AI governance and risk management, including as a module lead for the Cambridge Centre for Alternative Finance's programme for financial authorities. See the courses and workshops, read more on AI risk management, or get in touch.