Worked example: three lines of defence applied to AI

Every regulated firm in this sector already runs three lines of defence. The model transfers to AI with two complications that are worth naming before the example, because they are where the structure quietly stops working.

The two complications

The first line often cannot assess its own tool. The model that underpins three lines is that the business owns and manages its risks, with the second line setting the framework and challenging, and the third providing independent assurance. That presumes the first line understands the risk it owns. A claims manager deploying a vendor triage tool may have no basis on which to judge its data provenance, its performance for particular groups, or its failure modes. The answer is not to move ownership to the second line, which breaks the model. It is to give the first line the artefacts it needs to own the risk: the instructions for use, the test record, the monitoring output.

The builders sit in an awkward place. A central data science team building models for the business is doing first line work for a first line it does not belong to. If it also tests, signs off and monitors its own output, the firm has one line pretending to be three. FINMA's expectation of independent review separate from the developing unit addresses exactly this.

Worked example: an insurer assigns the lines over claims triage

A composite insurer deploys a model that triages motor claims into fast-track, standard and investigate. Data science built it. Claims operations runs it. Here is the allocation that works, and the arguments it settles.

First line: claims operations. The head of claims is the business owner. She owns the decision to use the system, the residual risk accepted, the oversight role and its intervention log, and the duty to use the system per its instructions. She owns the customer consequence when a claim is wrongly routed to investigate and sits for three weeks.

The argument this settles: data science had assumed it owned the model risk because it built the model. It owns the build. It does not own the decision to use the output on customers.

First line, technical: data science. Technical owner. Owns the build, the test evidence, the logging specification, the monitoring implementation and the documentation pack tracking the deployed version. Does not sign off its own work for release.

Second line: risk and compliance. Owns the classification method and the classification record. Challenges the residual risk the business proposes to accept. Owns the decision whether an event is a reportable incident and under which deadline: 15 days generally, 10 where a person has died, 2 for a widespread infringement or a serious and irreversible disruption of critical infrastructure. Reviews the thresholds set in advance for the performance and fairness tests, before the tests are run, which is the point at which second line challenge is actually worth something.

The argument this settles: whether compliance can require a test to be re-run. It can, because it owns the framework and the challenge, and because a threshold agreed after results are known proves nothing.

Model validation, second line: validates the model as a model, in the insurer's own context rather than accepting the vendor's validation where a vendor component is involved. Conceptual soundness, ongoing monitoring and outcomes analysis, with proportionate tiering by materiality and a view of aggregate model risk across the estate.

Third line: internal audit. Assures that the whole thing operated. Audit's questions here are procedural and they are the ones that find real problems: was the classification record countersigned by the business owner; were the fairness thresholds set before the test ran; were approval conditions closed or reported as overdue; were the logs retained for the full six months; was the oversight override ever exercised, and if never, why not; and does the documentation pack correspond to the version actually running.

What the allocation produced

Six months in, the model drifts as a new vehicle segment enters the book. Monitoring, owned by data science, detects it. The business owner, owning the decision, suspends fast-track routing for that segment and notifies the provider of the vendor component, discharging the Article 26 duty to monitor and inform. Compliance assesses whether the affected customers experienced an infringement of rights protections amounting to a serious incident, decides it does not, and records the reasoning and the decision in the incident log.

Internal audit reads that log entry at the next review and tests the reasoning rather than the outcome. That is the model working. Note how little of it depends on anyone having deep technical knowledge, and how much depends on each line holding an artefact the others can read.

The failure to watch for

Second line drift into doing the work. A compliance team that writes the classification, writes the impact assessment, chases the testing and drafts the minutes has become the first line for AI, and there is then no independent challenge in the firm. It happens gradually, always for good reasons, and it is visible in one metric: how many artefacts in the register were authored by someone outside the owning business unit.

As of 24 September 2026.