Model Risk Management

Organizations rely on models to make important decisions. Banks use them to approve loans, price products, measure capital and detect fraud. Insurers use them to set premiums and reserves. Retailers use them to forecast demand. When a model is built on flawed assumptions, trained on poor data, implemented incorrectly or used for something it was not designed for, decisions based on it can be badly wrong. Model risk management is the discipline of controlling this risk. It makes sure models are well designed, independently checked, properly used and monitored throughout their lives. It treats model risk as a risk to be managed, like credit or operational risk.

Model risk management is most developed in banking. For years, US banks followed supervisory guidance known as SR 11-7, issued in 2011. In April 2026, US banking agencies replaced it with revised, more risk-based guidance, issued by the Federal Reserve as SR 26-2. Many organizations outside banking have adopted similar practices, and AI governance programs often build on them. For risk, data science, finance and audit teams, model risk management provides proven methods for governing models, including many AI systems.

Definition of Model Risk Management

Model risk management is the framework of policies, roles and processes an organization uses to identify, measure and control the risk of adverse consequences from decisions based on incorrect or misused model outputs, covering model development, implementation, use, validation, monitoring and governance.

It provides many of the methods used in AI risk management, relies on model validation and is shaped in US banking by SR 11-7 and its successor guidance.

Core Elements of Model Risk Management

Model inventory records every model in scope, with its purpose, owner, risk tier, validation status and known limitations. An incomplete inventory leaves some models without any oversight.

Risk tiering classifies models by their materiality and complexity, so the most important models receive the most scrutiny. Lower-tier models can follow lighter processes.

Development standards set expectations for design, data, testing and documentation. Good documentation makes validation faster and more effective.

Independent validation challenges a model's conceptual soundness, tests its performance and checks its implementation before use and periodically afterward. Validators should have the expertise and standing to challenge model developers effectively.

Ongoing monitoring tracks performance, stability and use, and flags when models need recalibration or replacement. It also checks that models are used only for their intended purposes.

Governance defines roles, policies, approval authorities and reporting to senior management and the board. Clear governance gives validators the standing to challenge model owners.

Model Risk Management and AI

Many AI models, such as machine learning models for credit, fraud or pricing, fit naturally within model risk management. Their purposes and outputs resemble those of traditional statistical models.

AI can increase model risk, because complex models are harder to explain, may change as data shifts and may encode bias.

Generative AI and AI agents raise new questions, such as how to validate open-ended outputs and models supplied by vendors. The 2026 US banking guidance excluded generative and agentic AI from its scope, with regulators planning further work on AI.

Many organizations extend model risk practices to cover AI systems broadly, as part of their AI governance. This avoids building a separate process from scratch.

Importance of Model Risk Management in AI Governance

Model risk management prevents costly errors. Independent challenge and monitoring catch flawed models before they cause losses or harm. Errors in widely used models can affect thousands of decisions.

It supports regulatory compliance. Banks and insurers are expected to manage model risk, and supervisors review their programs.

It also provides a foundation for AI governance. Its inventory, tiering, validation and monitoring practices translate well to AI. Organizations with strong model risk practices often find AI governance easier to build.

Model Risk Management and Financial Management

Model errors can cause large losses, mispricing, capital shortfalls and regulatory penalties. These costs are often far greater than the cost of validation.

Validation and monitoring require skilled staff and tools, so risk tiering concentrates effort on material models.

Clear documentation and validation can speed regulatory reviews and reduce remediation costs.

Retiring redundant or poorly performing models reduces maintenance costs and risk at the same time.

Common Challenges

Complete inventories are hard to maintain, especially when models are built in spreadsheets or embedded in vendor products. Clear definitions of what counts as a model help.

Validation teams can become bottlenecks as the number of models, including AI models, grows. Tiering and automation help validators focus on what matters most.

Applying traditional validation methods to complex AI and generative models requires new techniques. These include testing outputs at scale and evaluating behavior rather than just accuracy.