Independent analysis by Jonas Mohamed Osman Abdelghafour, known as Yonas Osman, CEO of Quantica Risk Modelling. Educational information only; legal obligations depend on role, system and jurisdiction.
General-purpose AI creates a responsibility question that is easy to overlook in procurement: is the organisation developing, adapting, integrating or deploying the system, and which duties belong to each role? A financial institution should document that boundary before a model is embedded in a customer or risk process.
Map the AI supply chain
Record the foundation model, fine-tuning provider, retrieval layer, application owner, cloud host and business user. Identify who controls training information, updates, safeguards, logs and incident communication. A contract with an application vendor may still leave the institution responsible for how the system is used.
Control downstream adaptation
Fine-tuning, tool access, retrieval data and prompts can change the system's risk profile. Require a new assessment when the purpose, data, output or customer impact changes. Do not assume that a vendor's general assurance report covers the institution's configuration.
Make role evidence auditable
Keep a responsibility matrix, technical documentation, approved purpose, model version, monitoring results and incident route. The Commission's GPAI guidance and AI Act text provide the legal reference points.