AI Hallucinations Affecting Technology & Data at Statutory Boards & Agencies Firms in International Jurisdictions

Findings — impact summary

This is the consolidated view of findings. Click 'see details →' on any item for the full details for each finding.

1. Finding 1. NIST Cybersecurity Framework citation in CPMI-IOSCO Cyber GuidanceRLB-F-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q008

   A Technology & Data team that accepts the AI's assertion at face value may record in its regulatory mapping documentation that the CPMI-IOSCO guidance formally aligns to the NIST CSF, COBIT, and ISO/IEC 27001 — and may then structure its cyber resilience programme, supplier due-diligence criteria, and internal audit frameworks around that characterisation. If the formal citation does not exist in the source document, the firm has built its compliance posture on a fabricated regulatory baseline. In the event of a supervisory review or cyber incident, the regulator will assess the firm's controls against the guidance as written, not as the AI described it; a demonstrable gap between the two could result in mandatory remediation, supervisory undertakings, or formal findings against the firm's technology risk governance.

   see details →