AI Compliance Framework for a Public Sector Entity
Client profile: National regulator
Regulator about to publish AI guidance to supervised entities, with no internal AI policy of its own. We delivered the internal policy, model inventory, generative AI guardrails, and board-level oversight.
Headline metrics
- Policy adoption
- Board-approved
- Use cases governed
- 12
- Months to operating
- 6
- Independent review
- Quarterly
Summary
Challenge
A national regulator was about to publish AI guidance to its supervised entities and recognised it needed to operate its own AI under the same expectations. No internal AI policy, no model inventory, and growing use of generative AI for analyst productivity created internal-audit exposure.
Approach
Magnis AI co-developed an internal AI policy aligned with NIST AI RMF, ISO 42001, and the entity's enabling legislation. We delivered the model inventory, generative AI acceptable use guidelines, evaluation harness, and a board-level oversight charter. Sensitive use cases were brought into a structured review process.
Outcome
Entity now operates under documented AI policy with quarterly assurance reporting. Generative AI use is governed and instrumented. The published guidance to supervised entities references practices the regulator itself has implemented, strengthening enforcement credibility.
Engagement narrative
Why the regulator acted
A national regulator was preparing AI guidance for its supervised industries. Internal review found the regulator itself had no documented AI policy, no inventory of AI use cases (including informal generative AI use by analysts), and no governance over sensitive applications such as analytical models used in supervisory work. Publishing rules to others while having no internal rules was an unsustainable position.
Policy development (months 1 to 2)
Magnis AI co-developed an internal AI policy aligned with NIST AI RMF, ISO 42001, and the regulator's enabling legislation. The policy covered acceptable use, generative AI guardrails, model lifecycle, third-party AI risk, and incident reporting. Two iterations through legal, internal audit, and the executive committee. Board approval at end of month 2.
Inventory and classification (months 2 to 3)
Surveyed all departments for AI use cases. Identified 12 in-scope systems plus widespread informal generative AI use by analysts. Each in-scope system classified by risk tier and assigned a named model owner. Generative AI use brought into a structured acceptable use guideline with logging and prohibited-use list.
Engineering controls (months 3 to 5)
Evaluation harness built for analytical models used in supervisory work. Generative AI use channelled through a sanctioned enterprise tier with logging, output review for sensitive queries, and a quarterly compliance dashboard for the executive committee.
Outcomes
Entity now operates under board-approved AI policy. Quarterly assurance reporting to the executive committee. Generative AI use instrumented and bounded. The regulator's published guidance to supervised entities now references the practices it has implemented itself, materially strengthening its enforcement credibility.
Client testimonial
“We needed to be able to say credibly that we follow what we ask others to follow. Magnis AI delivered the policy, the controls, and the operating model that lets us say that with evidence.”
Deputy Director, national regulator