Proposal: Adoption profile for resource-constrained financial institutions (scaled implementation tiers for AIGF)

### Contact Details h.mahmod@gmail.com ### What is the idea AIGF v2.0 is a substantial achievement — 23 risks with mitigations cross-referenced to OWASP, MITRE ATLAS, and the EU AI Act, and the move toward enforceable runtime controls is exactly the right direction. This issue proposes a complementary deliverable that extends two threads already open here: #251 (1-pagers to help FSIs adopt AIGF and drive buy-in) and the jurisdiction-mapping pattern started in #253. The proposal is an **adoption profile for resource-constrained institutions** — a mapping of the framework to what an institution without a dedicated AI team, with a small compliance function and a vendor-dependent technology stack, can realistically implement. This class is larger than it may appear from inside the framework's current member base. It includes US community banks, credit unions, and CDFIs; mid-tier and regional banks in most markets; and the majority of banks and microfinance institutions in developing economies — institutions that may be large by customer count yet operate with a fraction of the specialist capacity the catalogue implicitly assumes. ### Why is it a good idea The current catalogue presumes capabilities typical of large, globally active institutions: model-risk-management teams, in-house ML engineering, security operations able to consume MITRE-mapped controls, and counsel tracking multi-framework cross-references. Most of the world's regulated financial institutions have none of these. For them, an undifferentiated mitigation catalogue isn't a roadmap; it's a reason not to start. The result is a familiar pattern: governance frameworks get adopted where capacity already exists, while resource-constrained institutions — often serving exactly the populations where responsible AI matters most — either stay out of AI entirely or adopt vendor AI with no governance layer at all. Both outcomes work against AIGF's adoption objective reflected in #251 — helping FSIs understand the framework, secure buy-in, and follow a practical adoption path — and both concentrate AIGF's benefits in the segment that needs them least. I've spent the last several years leading strategic initiatives at one of the largest banks in an emerging market, where the central challenge was exactly this: adapting sophisticated governance and technology practices to a resource-constrained delivery environment. I'm now focused on open, community-governed approaches to responsible AI for institutions in this class — including US community banks, credit unions, and CDFIs. Happy to draft the initial tier mapping as a starting point if maintainers think this fits AIGF's scope or the #251 workstream, or to adjust the shape to match the roadmap. ### How does it work? A tiered adoption profile, maintained within AIGF and structured as modular components in line with the plugin-style contribution approach suggested in #203: 1. **Tier mapping** — classify the catalogue's mitigations by implementation weight (e.g., policy-only / configuration-level / engineering-required), so an institution can see its minimum viable governance posture at its actual capacity level. 2. **Priority subset** — a defensible "first twelve" (or similar) for the use cases these institutions actually deploy first: vendor-supplied chat/service AI, document processing, and AI-assisted underwriting or onboarding. 3. **Vendor-dependency annotations** — for each mitigation, note whether an institution dependent on a core processor or third-party AI provider can implement it directly or must contract for it, since most resource-constrained institutions consume AI through vendors rather than building it. 4. **Jurisdiction-extensible regulator crosswalk** — a plain-language mapping from the priority subset to applicable supervisory expectations, following the modular jurisdiction pattern #253 has started for Canada. A US worked example (fair lending / ECOA, model-risk guidance, third-party-risk guidance) c