Letter to NIST on the RFI re: NIST Assignments in Executive Order on Artificial Intelligence

The American Bankers Association (ABA) appreciates the opportunity to comment on the request for information (RFI) related to National Institute of Standards and Technology's (NIST) assignments under sections 4.1, 4.5 and 11 of the October 30, 2023 Executive Order on Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence as published in the Federal Register on December 21, 2023 (EO).

NIST is uniquely positioned to build upon the success of its AI Risk Management Framework (AI RMF) by developing a complement to address the unique opportunities and challenges presented by generative AI (GenAI) and prompt-based large language models (LLMs). We urge NIST to continue to approach any new content for the AI RMF as industry-agnostic, customizable, and non-binding. At the same time, NIST should recognize the prominent role it enjoys in the ecosystem, which will only increase in the wake of the EO. The AI RMF and any supplemental materials may become an integral part of each sector’s best practices, integrated into contractual provisions, and referenced by regulatory agencies. Accordingly, NIST must thread the needle to find the appropriate balance between universality and fitting into existing regulatory regimes.

In summary, the ABA:

• Encourages NIST to consider the banking industry’s approach as a possible solution for other industries given that banks are at the forefront of the responsible AI movement due to the mature and flexible risk management framework at its core, which is subject to oversight by industry-focused regulatory agencies;
• Requests NIST to develop voluntary standards in harmony with regulatory requirements given that financial institutions are subject to numerous regulatory requirements with respect to the use of AI, including third-party risk management, model risk management and cybersecurity;
• Requests NIST to clarify what outputs need to be subject to AI governance;
• Encourages NIST to define “red-teaming” given that the term is used in many ways and lack of clarity could raise concerns;
• Applauds efforts to reduce the risk of synthetic content given GenAI can generate synthetic content leading to the creation of deepfakes that can be used to perpetrate fraud and causing mis- and dis-information but also encourages NIST to recognize the positive uses of synthetic data to advance privacy and trade secret protection and ensure it does not inadvertently prevent GenAI’s development; and
• Generally supports efforts to advance global technical standards that accommodate the risk management needs (including regulatory compliance requirements), that are technology neutral, risk-based, and tailored to use cases.

Download the comment letter to read the full text.