Some thoughts on this (also with the ex-regulator hat on):

• Management bodies should acknowledge the challenge and be thoughtful around
  how to address this, e.g. through training; reporting; succession planning
  etc.
• We recently heard from a regulator that they were worried that sometimes
  these topics are ‘outsourced’ to one person on the exec/ Board who
  understands it, whereas they are looking for broader skills and knowledge in
  the group. Again I think this is important to acknowledge, including the fact
  that building those muscles take time
• In terms of ‘evidencing’ appropriate oversight and challenge by the Board,
  when supervisors look at meeting minutes they would expect to see critical
  questions being asked and a level of discussion (rather than the Board just
  ‘noting’ things)
• The quality of the materials and reports being presented to the Board is very
  important, both data, but also someone bringing out the ‘so what’ and in
  particular where there are areas of judgement and uncertainty, and where
  there are trade-offs

Likewise, I wonder whether we feel things like BCBS239 and GDPR are also good bases for expectations around understanding of underlying data sources and uses? Of course, execs and boards will need to more specific training around the more complex AI models