How to complete the MFSA AI self-assessment

What the MFSA asks for

The Dear CEO letter on AI that the Malta Financial Services Authority issued on 4 June 2026 sets supervisory expectations in five areas, namely governance and oversight, third-party dependencies and concentration risk, model risk and reliability, data governance, and operational and systemic risk. To help firms test themselves against those expectations, it attaches Annex 1, a question register titled AI-Enabled Process & Vendor Mapping Self-Assessment.

Each question in the register comes with two columns, the evidence you will need and what you must produce. That structure makes the self-assessment closer to an audit file than a questionnaire. Answering “yes” is not enough. The MFSA expects the artefact behind the answer.

The letter expects the assessment to be comprehensive and critical, and to cover both current use of AI and anticipated developments. It does not need to be submitted, but the firm must be able to show three things on request. The assessment was done, the board and senior management considered its outcomes, and remediation is under way.

Start with the process and tool inventory

Section A of the register is the foundation, and the rest of the assessment is only as good as it is.

List every business-critical process and its sub-steps. The first question asks whether you have listed all business-critical processes, broken each into sub-steps and named every tool used at each step, including office automation and small scripts. The evidence is a register, process maps or swim-lanes, and screenshots or procedures showing the tools. You produce totals of processes, sub-steps and tools, and tools per process.

Identify vendors and sub-vendors. For each tool, the register asks for the primary vendor and the material sub-vendors behind it, such as the cloud or hosting provider, the AI model provider and key data providers. This is where fourth-party AI surfaces, for example a CRM or document tool that calls a third-party model.

Detect and classify AI. For each tool, confirm whether it includes AI. If it does, record the type (machine learning, generative AI, natural language processing, computer vision or agentic tools), who provides it, where it runs including the cloud region, and the exact function it performs.

Tag autonomy, materiality and impact. Each AI use is tagged with an autonomy level (none, assist, human in the loop, partial or full), a materiality rating (low, medium or high), and whether it can affect customers or markets. The evidence includes approvals showing who authorised the autonomy level and its safeguards.

Most firms find AI they did not know about at this stage, particularly generative AI features switched on inside existing software. The MFSA’s own 2025 assessment found many firms rely mainly on externally provided generative AI tools. A shadow AI search and a single AI system register make this section repeatable instead of a one-off spreadsheet.

Data governance and flows

Section B asks you to map data lineage and flows for each AI-enabled tool, confirm the lawful basis, consent and reuse controls for the data it uses, and show how bias, performance and drift are monitored. For tools from vendors, that means knowing what data leaves the firm, where it goes and whether the vendor may reuse it. Monitoring coverage is a common weak point, and drift monitoring is what turns a one-time validation into the ongoing assurance the letter describes.

Governance, accountability and board information

Section C asks whether every line in the register has a named business owner, model owner, data owner and vendor owner, whether financial crime compliance, compliance and IT are involved in overseeing AI that touches their remit, and whether the board receives complete management information on AI and vendor risk. This is the section that lets the board show it has considered the outcomes, so build the board pack from the register itself rather than writing it separately.

Third-party risk and change control

Section D brings AI into the outsourcing and ICT risk controls the firm already runs. It asks about controls per vendor, visibility of fourth parties and concentration risk, and whether AI-enabled tools follow change control with versioning, approval and testing, a tested rollback plan and an accessible kill switch. Where a vendor changes the model behind its product, the firm needs to know. Aicura’s vendor AI risk guide covers the due diligence side.

Conduct and market questions

Section E covers customer-facing AI. Are customers clearly told when they interact with AI, can any customer easily reach a trained human, and does the firm track how quickly the handover happens, especially for vulnerable customers? It also asks whether AI-supported decisions create risks of bias or financial exclusion, and whether outcomes are explainable and open to effective challenge. A final question, where applicable, covers shared data and model dependencies, correlation and herding risk, and stress scenarios with kill switches or manual overrides.

Taking it to the board

Close the exercise with three outputs. The completed register with its evidence, a summary of findings ranked by materiality, and a remediation plan with owners and dates. Minute the board’s consideration of all three. That is the record the MFSA has said it may ask to see.

How Aicura supports the work

Aicura’s discovery finds AI tools in use across the organisation, and its register holds each system with its owner, vendor, autonomy, materiality and customer impact. Vendor due diligence, risk assessments, oversight records, incidents and production monitoring sit against the same entries, and from Pro, Aicura drafts the board report from that governance record. It supports the work the MFSA’s letter asks for. The judgements and the decisions stay with the firm.

This guide is Aicura’s reading of the MFSA letter and its annex. It is not regulatory advice. Read the letter on the MFSA website and take advice on how it applies to your firm.