Why does AI not need a parallel system?
Bias, hallucination, model drift, privacy risk, vendor AI and shadow AI are not a separate universe. They must be translated into internal controls and risk management: control objectives, owners, evidence and escalation routes.
ISO/IEC 42001 offers a management-system framework. The EU AI Act adds concrete role, deployer, high-risk, logging and incident obligations. Good governance connects both with the existing processes of the corporation. That governance is expected beyond the high-risk categories is shown by EIOPA's opinion on AI governance (6 August 2025) and the joint statement of the EBA, EIOPA and ESMA on ICT risks from frontier AI (31 July 2026) – supervisory guidance, not new legal acts.
Which control objectives match which AI risks?
Five AI risks with one control objective each: incomplete inventory, bias, model drift, vendor AI and incidents.
| AI risk | Control objective |
|---|---|
| Incomplete inventory | All AI systems are captured, classified, assigned to an owner and reviewed regularly. |
| Bias or discrimination | Risk analysis, testing concept, human oversight and complaint/escalation routes are documented. |
| Model drift | Performance metrics, review cycles and thresholds for reassessment or deactivation are defined. |
| Vendor AI | Supplier information, Art. 25 role allocation, contractual records and update processes are traceable. |
| Incidents | AI Act, GDPR, DORA/NISG and internal escalations are assessed separately and coordinated. |
How does the three-lines model split AI responsibility?
The first line consists of business units and system owners: use, controls and ongoing monitoring. The second line coordinates compliance, risk, privacy and information security. The third line independently checks whether the model works and evidence is reliable.
The cycle should report regularly to management and, where relevant, to the supervisory board: inventory status, high-risk systems, open measures, incidents, audit findings and material changes.
Ing. Mag. Patrick Eiler
Patrick Eiler advises banks and insurers in Vienna on regulatory reporting, data architecture and AI compliance. More than twenty years in banking, insurance and financial services; speaker at the Hypo-Verband (expert session of 23 September 2026).