Self-Assessment
Six questions. Two minutes. Determine which of the CRI FS AI RMF's 230 control objectives apply to your institution and where your governance gaps are most likely to appear.
Question 1 of 6
Dimension 1 of 6: Business Integration
How deeply are AI systems integrated into your institution's business operations?
Select the statement that most closely describes your current state.
We are exploring AI or running isolated pilots that do not touch production systems or customer-facing processes.
AI supports specific business functions (fraud detection, credit scoring, customer service) in production, but with limited scope and manual oversight at key decision points.
AI is deployed across multiple business lines and handles regulated or customer-impacting decisions with defined automation thresholds.
AI operates at the core of the institution, powering high-stakes decisions across lending, trading, compliance, and customer engagement with minimal manual intervention and full regulatory data exposure.
Dimension 2 of 6: Governance Maturity
How would you characterize your institution's AI governance program?
Select the statement that most closely describes your current state.
We have no formal AI governance program. AI oversight is ad hoc, handled by individual teams or project sponsors without centralized coordination.
We have documented AI policies and a designated governance body, but enforcement is inconsistent and coverage is incomplete across business units.
We have an established AI governance program with regular risk assessments, defined accountability, and integration into the enterprise risk framework.
AI governance is indistinguishable from how the institution operates: embedded into planning cycles, compensation structures, risk reporting, and board-level decision-making with continuous maturity assessment.
Dimension 3 of 6: Deployment Architecture
How are AI systems developed and deployed at your institution?
Select the statement that most closely describes your current state.
We primarily use off-the-shelf vendor tools with minimal customization. No internal model development capability.
We use a mix of vendor platforms and some internally developed models, deployed in controlled environments with manual promotion to production.
We maintain both vendor-managed and internally built AI systems with automated deployment pipelines and structured model lifecycle management.
The institution maintains a heterogeneous AI estate spanning internal builds, cloud-hosted vendor models, and bespoke systems, all governed through automated deployment pipelines with unified monitoring and lifecycle management.
Dimension 4 of 6: Third-Party AI Reliance
To what extent does your institution rely on third-party AI vendors?
Select the statement that most closely describes your current state.
We use minimal third-party AI. Any vendor AI tools are peripheral (e.g., basic chatbot, email filtering) and not integrated into core operations.
We rely on a few third-party AI vendors for specific functions (fraud detection, KYC/AML, document processing) with standard vendor management oversight.
We use multiple third-party AI vendors across several business functions, including some customer-facing applications, with AI-specific due diligence and contractual controls.
Third-party AI is embedded across the value chain: underwriting, servicing, surveillance, and customer interaction. Vendor models process regulated data and influence material decisions with full contractual and governance oversight.
Dimension 5 of 6: Strategic Ambition
What are your institution's primary objectives for AI adoption?
Select the statement that most closely describes your current state.
We are primarily exploring AI for basic operational efficiency: reducing manual processes, automating routine tasks, and improving internal workflows.
We are using AI to improve customer experience and operational efficiency, with specific use cases in production that deliver measurable business value.
AI is a strategic priority across multiple business objectives: efficiency, customer experience, risk management, regulatory compliance, and competitive positioning.
AI is a board-level strategic priority driving new revenue models, market positioning, and institutional identity, with explicit commitments to responsible deployment, regulatory leadership, and measurable ethical standards.
Dimension 6 of 6: Generative AI Exposure
How is generative AI (ChatGPT, Copilot, LLMs) used at your institution?
This dimension addresses the regulatory gap created by SR 26-2's explicit exclusion of generative and agentic AI from model risk management guidance.
We have not adopted generative AI, or usage is limited to informal experimentation without institutional awareness or policy.
Employees use generative AI tools (ChatGPT, Copilot) for productivity, but we have a basic acceptable use policy and no systematic monitoring of usage patterns or data exposure.
We have enterprise-licensed generative AI tools with documented acceptable use policies, data classification controls, and periodic review of usage, but limited technical safeguards (prompt injection testing, output monitoring).
We deploy generative AI in customer-facing and decision-support applications with comprehensive governance: prompt injection testing, output monitoring, data leakage prevention, human oversight thresholds, and incident response procedures specific to GenAI failures.
Your Assessment
This assessment identifies your adoption stage. The diagnostic identifies your specific gaps, quantifies your exposure, and delivers a prioritized remediation roadmap your board and examiners can act on.
This self-assessment provides an indicative adoption stage based on the six governance dimensions defined in the CRI Financial Services AI Risk Management Framework. It does not constitute a formal gap analysis, compliance certification, or regulatory assessment. A comprehensive diagnostic requires direct examination of your institution's model inventory, policies, and governance artifacts. See Terms of Service for full disclaimers.