Generic patterns for keeping humans accountable when talking to AI in operations. Illustrative only, not a statement of compliance.
AI drafts; accountable people decide.
Every AI output is labelled, timestamped and marked 'human review required'. The Knowledge Dojo blocks saving until a reviewer ticks the review box.
Named approvers per use case, review recorded in the ticketing or knowledge tool, and no autonomous changes to production without a change record.
Prove quality before widening rollout.
Outputs use fixed structures and ask the AI to state its confidence and missing information, so weak answers are visible.
A golden test set of real (sanitised) cases, accuracy and hallucination checks against it before each wider rollout, and re-testing after model or instruction changes.
No personal or confidential data in AI conversations.
All data is synthetic, and input screens warn visitors not to paste confidential or personal information.
Data classification rules, redaction before sending, approved tools only, and Canadian privacy law considerations reviewed with privacy counsel.
Treat AI models as models, with inventory, validation and monitoring.
OSFI Guideline E-23 Model Risk Management, final September 11, 2025, effective May 1, 2027, brings AI/ML models into scope — illustrative.
Each AI use case registered in the model inventory with a risk rating, owner, validation evidence and ongoing performance monitoring.
Every AI call is traceable.
Each AI call is logged with session, feature and timestamp. Live count for this session is shown below.
AI calls logged this session: 0
Centralised logs of who asked what, which model answered, and what was accepted, retained to the records policy.
Spend is bounded and predictable.
Each visitor session is limited to 10 AI calls per 24 hours; buttons disable when the limit is reached.
Per-team budgets, usage dashboards, rate limits and alerts on unusual consumption.