Model Risk Management: The Bank Discipline AI Inherits

BusinessSafety and governancePublished By Simon Budziak

Model risk management is the discipline of identifying, measuring and controlling the risk that models produce wrong or harmful results. Born in bank regulation, it now extends to AI and machine learning models, and its machinery, inventory, validation, effective challenge, is what AI governance borrows.

What does model risk management require?

Four pieces that recur in every framework. An inventory: every model in use, its purpose, owners and dependencies, so nothing consequential runs unrecorded. Independent model validation before use and on a schedule. Governance: board-level oversight, policies, and clear accountability. And lifecycle control: monitoring for model drift, change management, and retirement. The canonical source is the US supervisory guidance on model risk management, SR 11-7 as revised by the April 2026 interagency guidance, whose guiding principle is effective challenge, critical review by qualified people independent of the model’s builders (Federal Reserve, Supervisory guidance on model risk management, read 26 October 2026). A model nobody independent has challenged is an assumption wearing a dashboard.

Why does model risk management matter for AI?

Because AI systems are models with the dial turned up. The guidance’s own risk drivers, complexity, input uncertainty, breadth of use, impact, all increase with LLMs and agents, and supervisors are updating accordingly: the Bank of England’s SS1/23 principles treat model risk as a risk discipline in its own right, and Canada’s OSFI Guideline E-23, effective May 2027, covers AI and machine learning models explicitly (OSFI, Guideline E-23, read 26 October 2026). The aggregate view matters most for AI: models that share data, assumptions or one upstream provider can fail together, which is precisely the position of a company running many use cases on one foundation model.

How should a non-bank apply MRM to AI?

Proportionately, keeping the skeleton. Start with the inventory, including the AI uses embedded in vendor software, because unlisted models are where incidents start. Tier by consequence: a model that prices, screens people or moves money gets validation and monitoring; a drafting assistant gets lighter treatment. Assign each tiered model an owner and an independent challenger, even if the challenger is one skeptical colleague with a test set. This is the piece of AI risk management with decades of operating history behind it, and it slots under a company’s broader AI governance rather than replacing it.

This entry was drafted with AI assistance.

Frequently asked questions

What is model risk?

The risk of loss from decisions based on a model that is wrong, misused or has drifted. It grows with model complexity, uncertainty about inputs and assumptions, breadth of use and the size of what the model influences.

Does model risk management apply outside banks?

Increasingly yes. The framework came from bank supervisors, but insurers, energy traders and any company making consequential automated decisions now borrow it, and newer guidance such as Canada's E-23 explicitly covers AI and machine learning models.

What is effective challenge in model risk management?

Independent, informed review by people with the standing to find a model's flaws and force changes. It is the core principle of the US supervisory guidance: every important model gets challenged by someone who did not build it.

Summarize this page with
ChatGPTClaudePerplexity

See this working in a system we built