Your own policy requires validation the estate does not have
AI policy (3.1) commits to independent validation of the models that reach a consumer. That is your own commitment, and MDL-001 Claims triage does not meet it. A missing validation on its own is one finding. This is worse than that, because a reviewer who reads your policy and then looks at your estate learns that the policy describes a practice you do not follow. Once they have found one control that exists only on paper, they start checking the others the same way.
To fix: Close the gap or amend the policy. Leaving a commitment in force that the estate does not meet is the more expensive of the two options.