Regulated entities
Banks, insurers, superannuation and pension funds are being asked to oversee AI within appetite, including AI inside third parties and the platforms behind them. Most of the record that would show it does not exist yet. The AI Use Assessment finds what can be produced, provider by provider.
Choose your jurisdiction
Each jurisdiction page sets out what your supervisor has asked, by when, and what can be evidenced against it.
Australia · APRA
The AI letter of 30 April 2026, CPS 230, the FAR, and the Privacy Act from 10 December 2026.
Australia →Singapore · MAS
The MAS Guidelines on AI Risk Management, and contract terms on the renewal cycle.
Singapore →Canada · OSFI
Model risk under Guideline E-23, third parties under Guideline B-10, and Quebec's automated-decision rules.
Canada →European Union
The AI Act for credit and insurance uses, and DORA's register and contract terms, already in force.
European Union →Several supervisors
The most specific text with the earliest date sets the group's clock.
Several supervisors →The chain
The obligation reaches the agreements with your providers. What evidence of AI behaviour satisfies it is still undefined, and most providers have not been asked.
Accountable
Holds the agreements, sets the board's appetite, and carries the accountability.
Third party
Core banking, policy or fund administration; claims or credit decisioning; fraud and AML monitoring.
Fourth party
The technology, pricing or AI model the provider relies on.
Copilots and assistants used by your own legal, claims, credit and compliance staff. You control your own end of this boundary.
Three halves
We work with large law firms and board risk advisers in alliance with Triodian, or with your own. Each party is engaged and paid directly; no referral fees in either direction.
The board decides
In facilitated sessions, recorded as the board's own positions. Your board risk adviser can facilitate.
Counsel decides
Reach under each agreement, what is requirement and what is expectation, accountability steps, and privilege.
Triodian tests
The register of where AI acts, the evidence obtainable at each boundary, and a finding per arrangement.
The seven questions
Questions 1 to 4 are ones your third-party risk work already asks. Questions 5 to 7 are the AI-specific ones. Each jurisdiction page restates them in its supervisor's terms.
Two questions sit under all seven: what can you require, and what can actually be produced? The determination at each step is yours and your counsel's.
Where it stops
Every legal determination is yours and your counsel's. Legal questions go to counsel in writing.
The measure is your supervisor's expectations and your board's appetite, not any product.
No customer data, no individual decisions, no system access, no access to a provider's model.
Where you hold no rights, that is recorded honestly. The work can stop at the findings.
Regulatory position as at 26 October 2026. Not legal advice: every legal determination is yours and your counsel's.