Danish FSA recommendations when using artificial intelligence

What it is

Finanstilsynet, the Danish Financial Supervisory Authority (DFSA), published its good practice paper on using artificial intelligence on 29 May 2024. It is published in English as Recommendations when using artificial intelligence. It builds on the DFSA’s 2019 recommendations on supervised machine learning, which came out of a test in its FT Lab sandbox, and is meant to be read together with them.

The DFSA wrote the paper because generative AI had moved AI up the agenda inside financial firms, and it wanted to keep the pressure to keep up from crowding out good governance, risk management and sound company culture. The paper drew on meetings with AI experts, academics and representatives from across the sector. Ethics are covered separately in the DFSA’s report on data ethics when using AI in the financial sector, published on 13 November 2023.

Who it applies to

The paper is addressed to all regulated providers of financial services in Denmark, including banks, credit institutions, investment firms, market places, insurers, pension companies and payment institutions. The DFSA says the paper is not regulation in itself and will not on its own lead to supervisory reactions. It also says that firms covered by the executive orders on management and control of banks and of insurance companies will find that some of its good practice amounts to real requirements.

What it requires

The recommendations sit under three headings.

Governance. The DFSA’s good practice for a firm using AI is to do the following.

• Have a system that gives it an overview of its AI use, for example through the register of models that every firm should keep in any case.
• Decide how it handles the particular risks of AI-based models when it sets its risk approach, and what internal resources it has for that.
• Have an established approach to risk analysis and classification of AI use, for internally and externally developed models alike.
• Keep checking whether its existing policies cover the risks of AI, or whether they need updating or a separate AI policy.
• Place responsibility for specific models, including their control, with named staff or units who were not involved in developing them, where the model’s significance warrants it.

The paper describes risk tiering as one way of doing the classification, and notes that the method matters less than having one.

Model management. The good practice is to do the following.

• Consider from a risk perspective whether and how its AI-based models differ from its other models.
• Have a plan for retraining and regular validation, including for models bought from third parties.
• Check it has enough internal resources, including for validation, which should be independent of development for significant models.
• Have a policy for controlling and securing model versions, so that earlier versions can be recreated.
• Manage data effectively, including how data is stored and who has access to it.

The paper notes that AI models often need more frequent retraining than classical models, and that changes in customer behaviour, interest rates or data sources can mean the training data no longer reflects reality.

Explainability. The good practice is to do the following.

• Document its thinking on explainability for specific models, including the trade-off with performance.
• Assess which skills should take part in that trade-off, rather than leaving it to the developer.
• Understand and be able to explain the unwanted outcomes or bias a model can produce.
• Assess each use case during development to set its explainability needs.
• Justify and document the choice of a complex model that is hard to explain, along with the mitigating measures it takes.

The DFSA expects more external explainability where a decision directly affects consumers, giving the examples of an insurer deciding on a claim and a lender approving or rejecting a loan. In those cases a customer should be told how a conclusion was reached, in more than technical terms.

Key dates

• 10 July 2019. Recommendations when using supervised machine learning published..
• 13 November 2023. Report on data ethics when using AI in the financial sector published..
• 29 May 2024. Good practice when using artificial intelligence published.

How it relates to other frameworks

The EU AI Act treats creditworthiness assessment and risk pricing for life and health insurance as high-risk uses under Annex III, and Article 74(6) makes the financial supervisor the market surveillance authority for high-risk systems used by financial institutions in direct connection with their financial services. For Danish firms the DFSA’s paper is therefore a good guide to how their supervisor thinks about AI ahead of those obligations, which apply from 2 December 2027. The Danish AI Act supplementary law sets out the national authorities that exist today.

The paper’s focus on a model register, independent validation, version control and documented model choices is close to established model risk guidance such as the US SR 26-2. Firms that want a management system around these practices often use ISO/IEC 42001. Aicura’s guide for Danish financial institutions works through how to put the recommendations into practice.

A note on this page

This is Aicura’s reading of the DFSA’s good practice paper. It is not legal advice and it is not the paper itself. Read the primary source published by the DFSA, and take advice on how it applies to your firm.