model risk management
In plain wordsThe rules banks and other firms follow to make sure the mathematical models and AI systems they rely on are built correctly, checked independently and used only for what they are fit for.
The discipline of finding, measuring and containing model risk, meaning the chance that decisions resting on a flawed or misapplied model cause losses or other harm, over the whole life of a model. Its canonical statement, the US supervisory guidance SR 11-7 (2011), counts as a model any quantitative method that converts input data into estimates by applying statistical, economic, financial or mathematical theory, and rests on three pillars: sound development, implementation and use; independent validation, comprising assessment of conceptual soundness, ongoing monitoring and outcomes analysis such as back-testing; and governance, including a model inventory, policies, documentation and clear roles. Its central principle is 'effective challenge': critical review by objective, competent people with the authority to force changes. Built for credit, market-risk and capital models, the framework now covers machine learningmachine learning, n.: A way of building software that learns from examples instead of following rules written by a programmer. Shown thousands of labeled photos, for instance, a program can learn to recognize cats. and generative AI in finance, where opacity, driftdata drift, n.: When the information flowing into an AI model in real use gradually stops resembling the data it was trained on — new customers, new slang, new cameras — making its predictions less reliable., third-party models and hallucinationhallucination, n.: When an AI states something false or made up — a fake fact, quotation or source — fluently and confidently, as if it were true. strain traditional validation.
Model risk management would not sign off on the credit model until validators reproduced its results and stress-tested it.
Origin
Issued on 4 April 2011 by the US Federal Reserve Board (SR Letter 11-7) and the Office of the Comptroller of the Currency (Bulletin 2011-12), after the 2007–2009 financial crisis exposed failures of risk models; the FDIC adopted it in 2017. The UK Prudential Regulation Authority's SS1/23 (2023) and Canada's revised OSFI Guideline E-23 (issued September 2025, effective May 2027) extend the approach explicitly to AI and machine learning.
Usage note
Many firms use model risk management as the template for wider AI governance: frameworks such as the NIST AI Risk Management FrameworkNIST AI Risk Management Framework, prop. n.: A free, voluntary guide from the US government's standards agency that helps organizations spot, measure and reduce the risks of the AI systems they build or use. and the EU AI ActEU AI Act, prop. n.: The European Union's law on artificial intelligence, the first broad AI law anywhere: it bans some uses, sets strict checks for risky ones and puts duties on the makers of the biggest AI models.'s duties for high-risk credit-scoring systems echo its inventory, validation and monitoring requirements.
Related
- AI governanceAI governance, n.: The rules, institutions and habits that shape how AI is built and used — from laws and treaties to technical standards and a company's own review processes.
- NIST AI Risk Management FrameworkNIST AI Risk Management Framework, prop. n.: A free, voluntary guide from the US government's standards agency that helps organizations spot, measure and reduce the risks of the AI systems they build or use.
- high-risk AI systemhigh-risk AI system, n.: Under EU law, an AI system used where mistakes could seriously hurt people's safety or rights — in hiring, schooling, loans, policing, borders or products like medical devices — and which must therefore pass strict checks.
- model cardmodel card, n.: A short document published with an AI model explaining what it is for, how it was trained and tested, how well it works for different groups of people, and its known limits.
- explainabilityexplainability, n.: How well the reasons behind an AI system's outputs can be put into terms that people can understand, check and, if needed, challenge.
- data driftdata drift, n.: When the information flowing into an AI model in real use gradually stops resembling the data it was trained on — new customers, new slang, new cameras — making its predictions less reliable.
Sources
- Board of Governors of the Federal Reserve System & Office of the Comptroller of the Currency (2011). Supervisory Guidance on Model Risk Management (SR 11-7 / OCC 2011-12).
- Prudential Regulation Authority (2023). Supervisory Statement SS1/23: Model risk management principles for banks. Bank of England.
Defined in law or standards
US Federal Reserve SR 11-7 and OCC Bulletin 2011-12, Supervisory Guidance on Model Risk Management (2011); UK PRA Supervisory Statement SS1/23 (2023); OSFI Guideline E-23, Model Risk Management (Canada, 2025)