iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
AI model risk management in banking is the discipline of identifying, assessing, controlling and monitoring the chance that a model’s assumptions, data, design, implementation, outputs or use will cause harmful decisions or financial consequences. It covers the full lifecycle—not just a validation report—including governance, intended-use controls, testing, monitoring, documentation and vendor oversight.
The current U.S. federal reference is the interagency Supervisory Guidance on Model Risk Management, issued April 17, 2026, by the Federal Reserve, Office of the Comptroller of the Currency and Federal Deposit Insurance Corporation. It replaces Federal Reserve SR 11-7 and the 2021 interagency statement on model risk management for Bank Secrecy Act/anti-money-laundering systems. The guidance is risk-based and expressly excludes generative and agentic AI models, which require controls under broader risk-management and governance practices.
What model risk means in a bank
A model is a complex quantitative method, system or approach that applies statistical, economic or financial theories to input data to produce quantitative estimates. A simple arithmetic calculation or a deterministic rule with no such theoretical underpinning is not a model for purposes of the 2026 guidance. An AI system can nevertheless be a model when it estimates a probability, value, score or other quantity using a quantitative method.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Model risk is the possibility that a model’s output, or a decision made using that output, is wrong or misleading. Consequences can include credit losses, inaccurate regulatory or financial reporting, poor liquidity or market-risk decisions, inappropriate customer treatment and missed financial-crime risks. The risk can arise even when software runs exactly as designed: an unsuitable objective, biased or incomplete data, unrealistic assumptions, coding defects, misuse outside the approved purpose or a change in the environment can all make an apparently functioning model unreliable.
#1 Best Overall
In banking, the practical question is not whether a model is labelled AI. It is whether the model’s use could materially affect the institution, its customers or its obligations, and whether controls are proportionate to that exposure.
What the April 2026 guidance changes—and what it does not
The agencies’ April 17, 2026 interagency guidance and the Federal Reserve’s related SR 26-2 letter establish a flexible supervisory framework. The guidance is expected to be most relevant to banking organizations with more than $30 billion in assets, but a smaller institution can face significant model risk and should apply the principles that fit its models, activities and complexity.
This is supervisory guidance, not a prescriptive regulation. It does not create enforceable standards, and failure to follow guidance alone is not a basis for supervisory criticism. A bank can still face supervisory action when a legal violation or unsafe or unsound practice results from inadequate model-risk management. Each organization remains responsible for choosing practices that effectively address its own risk profile.
Recommended Free Tools
The 2026 document supersedes SR 11-7 and the 2021 interagency statement focused on model risk management for BSA/AML systems. Its central change is an explicit risk-based approach: banks should not apply identical testing, approval or monitoring to every model. Complexity, assumptions, data constraints, business exposure, purpose, materiality and institutional operating complexity determine the depth of oversight.
Are generative and agentic AI covered?
No. The guidance states that generative AI and agentic AI models are novel and rapidly evolving and are not within its scope. Federal Reserve Vice Chair for Supervision Michelle W. Bowman made the same point in a May 1, 2026 speech, explaining that other risk-management and governance practices should support adoption of those technologies. Her speech is available at Artificial Intelligence in the Financial System.
This boundary does not mean a bank can deploy a generative or agentic system without controls. It means SR 26-2 is not the direct rulebook for that system. Banks should use applicable cybersecurity, privacy, third-party, operational, consumer-protection, compliance, data-governance and enterprise-AI controls, and should document how those controls address the system’s particular risks. A non-generative, non-agentic AI model that produces quantitative estimates can fall within the 2026 model-risk framework.
How a bank decides how much oversight a model needs
The guidance organizes risk around three connected ideas: inherent risk, exposure and purpose. Inherent risk reflects what could go wrong in the model itself. Exposure reflects the importance and scale of decisions that rely on its output. Purpose reflects why the model exists; a model supporting a regulatory requirement or financial-risk decision is generally more consequential than one used for a low-impact internal analysis. Purpose and exposure help determine materiality, and higher-materiality models warrant more comprehensive controls.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11| Risk dimension | Questions for the bank | Typical oversight consequence |
|---|---|---|
| Assumptions and complexity | How many assumptions, transformations, dependencies or opaque components affect the estimate? Can specialists explain the method? | More challenging methods and less transparent logic call for deeper conceptual review, alternative-method testing and stronger documentation. |
| Input data | Are data accurate, relevant, complete, timely and representative of the population and conditions in which the model will operate? | Weak data quality or severe data constraints increase testing, monitoring and remediation needs. |
| Exposure | How large is the portfolio, customer population or business process affected if the output is wrong? | Broad or financially significant exposure supports a higher materiality rating and more frequent review. |
| Purpose | Does the output support regulatory compliance, capital, credit, liquidity, market or other high-consequence decisions? | Regulatory and financial-risk uses generally receive more rigorous approval, validation and change controls. |
| Actual use | Is the model being used only for the approved purpose, or have users extended it to a new product, geography, population or decision? | An extension requires analysis of the new use and a review of whether existing controls remain adequate. |
| Institutional complexity | How large and operationally complex is the bank, and how many models, vendors and shared data assets does it manage? | Governance, inventory and aggregation should scale with the organization’s ability to create interconnected risk. |
Assessment must occur both model by model and in aggregate. Several individually moderate models can create concentrated risk when they share an assumption, data source, methodology, vendor, software component or economic scenario. Banks should examine interactions and dependencies that could make one defect affect multiple decisions at once.
The model-risk lifecycle, from idea to retirement
1. Define purpose and intended use
Start with a written business purpose, decision, population, output, users, frequency and boundaries. Development choices should follow that purpose and the bank’s policies. Define what the model is not approved to do—for example, a score developed for one portfolio should not silently become a decision engine for another. A clear intended-use statement makes later testing, validation and monitoring meaningful.
2. Choose data, method and assumptions deliberately
Model development is not merely a coding exercise. Designers make judgments about target variables, samples, exclusions, features, transformations, estimation methods, thresholds and assumptions. Record why those choices fit the purpose, what limitations they create and what conditions could invalidate them. Assess source ownership, lineage, access controls, missing values, measurement error, representativeness and changes in the data-generating process.
3. Test in proportion to complexity and materiality
Testing should be tailored to risk rather than performed as a checklist. Depending on the model, evidence can include:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute- Out-of-sample testing to determine whether performance generalizes beyond development data.
- Out-of-time testing to reveal deterioration across periods or changing economic conditions.
- Comparison of alternative assumptions, specifications or methods.
- Stress, sensitivity and scenario analysis for variables that could materially change the result.
- Checks of data quality, relevance, stability, documentation and implementation accuracy.
Test results should state the conditions under which the model works, where it does not, and what compensating controls are needed. A high score on a development sample is not evidence of reliability if leakage, overfitting or an unrepresentative sample is present.
4. Apply effective challenge
Effective challenge is critical analysis by people with suitable expertise, enough independence to remain objective and sufficient standing to require changes. Challengers should be able to question the objective, data, assumptions, methodology, implementation, test design and proposed use—not merely proofread documentation. The guidance emphasizes that the quality of validation depends on the rigor and effectiveness of review, not on a particular organizational chart. Independence can therefore be achieved in different structures, provided reviewers can influence decisions and are not conflicted by the model’s development incentives.
5. Validate before first use
Validation assesses whether a model performs as expected, how reliable it is and what limitations users must understand. It generally occurs before first use. In an urgent situation, a bank may use a model beforehand, but it should give greater attention to known limitations, communicate them to stakeholders and apply compensating controls until validation is complete.
A validation conclusion should be specific: identify unresolved findings, materiality, required remediation, usage restrictions, monitoring metrics, expiry or review dates and the person accountable for each action. Validation is one component of the lifecycle; a strong validation report cannot cure unsound development or uncontrolled use.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
6. Control use and communicate limitations
Users need practical information about what an output means, how it was produced, when it should not be relied upon and which overrides or escalation paths apply. Access, permissions, versioning and change management should prevent an unapproved model or obsolete version from driving decisions. Extending a model to a new product, geography, customer group or decision is a new risk assessment, not an informal convenience.
7. Monitor performance and outcomes
Ongoing monitoring looks for deterioration, persistent deviations, data drift, unusual overrides, threshold changes, implementation errors and outcomes that differ from expectations. Outcome analysis can reveal problems that conventional accuracy metrics miss, such as a model that remains statistically stable while producing systematically poor business or customer outcomes. Monitoring thresholds should trigger investigation, recalibration, restriction, redevelopment or retirement as appropriate. The cadence and depth should reflect materiality and the speed at which the model or environment can change.
8. Govern, inventory and document
Policies should assign accountability across development, independent review, approval, deployment, monitoring, issue management and retirement. A model inventory should contain enough information to understand each model’s purpose, owner, version, dependencies, materiality, validation status, limitations, vendors, uses and open findings. The inventory should also support aggregate analysis.
Documentation preserves institutional knowledge when staff, vendors or systems change. It should allow a reviewer to reproduce the model’s design and implementation, trace data and assumptions, locate approvals, track recommendations and exceptions, and demonstrate remediation. Missing documentation is itself a control weakness because the bank cannot reliably know what it is using or why.
9. Manage vendor and proprietary models
A vendor’s proprietary code or data does not transfer responsibility for model risk. Before approval, the bank should obtain enough information to understand conceptual soundness, design, development data, performance, limitations and intended use. Where access is restricted, the bank can use contractual rights, independent assessments, testing evidence, controlled data exchanges and outcome monitoring to close the information gap.
After deployment, monitor the vendor model and the bank’s implementation, not just the vendor’s release notes. Evaluate customizations, parameter changes, data mappings, interfaces and local overrides. Document what was changed, who approved it, how it was tested and whether the modified model still meets its purpose. Contracts should support timely notification of material changes, incidents and performance concerns.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What a proportional program looks like in practice
A smaller bank with a limited number of low-impact models may use fewer layers of formality than a complex institution, but it still needs clear ownership, an inventory, risk classification, independent challenge appropriate to the model, monitoring and issue escalation. A bank above $30 billion, or one with high-impact activities regardless of size, will generally need more comprehensive evidence, specialist expertise and aggregate-risk analysis.
| Program decision | Lower-risk example | Higher-risk example |
|---|---|---|
| Validation depth | Targeted review of a simple, stable model with limited exposure. | Independent conceptual, data, outcomes and implementation review for a complex model supporting material decisions. |
| Monitoring | Periodic performance and data-quality checks. | More frequent thresholds, drift detection, outcome analysis, escalation and documented remediation. |
| Change approval | Defined approval for minor, non-material changes. | Formal impact assessment, testing, revalidation or redevelopment before material changes take effect. |
| Aggregate analysis | Basic review of shared data and dependencies. | Portfolio-wide analysis of correlated assumptions, vendors, scenarios and concentrations. |
Common control failures and practical fixes
- Treating validation as the whole program: Add lifecycle controls for purpose, development, approved use, monitoring, governance and retirement.
- Applying the same checklist to every model: Classify inherent risk, exposure, purpose and materiality, then scale evidence and review.
- Approving a model for an undefined purpose: Write explicit intended and prohibited uses and require a new assessment for extensions.
- Relying on development performance: Use out-of-sample and out-of-time evidence, alternative methods and sensitivity analysis.
- Assuming a vendor is responsible: Obtain enough evidence to assess the vendor model, monitor actual outcomes and document customizations.
- Ignoring model interactions: Examine shared data, assumptions, methodologies and dependencies across the inventory.
- Leaving findings open without ownership: Assign a responsible person, due date, interim restriction and escalation route for every material issue.
- Using the 2026 guidance for generative or agentic AI: Treat those systems under broader enterprise risk and governance controls because they are expressly outside SR 26-2’s scope.
A practical implementation sequence
- Map the inventory: Identify quantitative models, non-generative AI models, owners, purposes, users, versions, vendors and dependencies. Confirm that simple deterministic tools are not being misclassified as models, while quantitative AI systems are not omitted.
- Classify risk: Rate assumptions and complexity, data constraints, exposure, purpose, materiality, change velocity and aggregate dependencies.
- Set governance: Define approval authority, effective-challenge responsibilities, validation independence, issue escalation, exception handling and retirement criteria.
- Document intended use: Specify outputs, populations, decisions, limitations, prohibited extensions and required human or procedural controls.
- Build a risk-based evidence plan: Select testing, validation, monitoring and review frequency that match the classification; include out-of-sample or out-of-time tests when relevant.
- Control deployment: Enforce versioning, access, change approval, release records and user communications before production use.
- Monitor and improve: Review performance and outcomes, investigate thresholds, remediate or restrict models when conditions change, and update the inventory and documentation.
- Address excluded AI deliberately: For generative and agentic systems, document the separate governance framework, owners, safeguards, monitoring and escalation that apply.
Why this matters to bank customers and supervisors
Sound model-risk management makes automated and quantitative decisions more explainable, controllable and resilient. It gives management and supervisors evidence that a model is fit for its approved purpose, that known limitations are visible, and that deteriorating results will trigger action. It also helps a bank avoid the false assurance that comes from a technically sophisticated model operating on unsuitable data or outside the conditions in which it was developed.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The governing principle is accountability tailored to risk. As the interagency guidance puts it, each banking organization is responsible for adopting model-risk practices appropriate and effective for the specific risks it faces or is likely to face. That principle, rather than a one-size-fits-all checklist, is the foundation of AI model risk management in banking.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
