Governance
Model risk management (MRM)
Also called: MRM, SR 11-7
Definition
Model risk management is the established discipline of inventorying, validating, and independently challenging models in use — a framework most financial institutions already have and most AI programs quietly bypass.
AI systems are models. The awkwardness is that traditional MRM assumes a stable, documentable model, while a hosted generative system changes underneath you and resists conventional validation approaches built for a fixed set of coefficients. The answer is not exemption but adaptation: inventory the deployment, validate the outcome rather than the weights, and re-validate on a cadence that matches how often the underlying system can actually change.
Validate the system, not the weights
You cannot inspect a vendor model's internals, and demanding that level of access is usually a non-starter commercially and technically. You can freeze a case set, define acceptable performance, and test the whole deployment against it independently of the team that built it, which produces a validation that is meaningful and defensible even without visibility into the model's internal parameters, because it evaluates the thing that actually matters: what the system does on real cases.
The inventory is the first gap
Most institutions cannot list the AI systems currently influencing decisions, because adoption has often happened faster than the governance function's ability to track it, with tools added department by department outside the traditional model-approval process. Until that list exists, every other control is theoretical, since you cannot validate, monitor, or independently challenge a system your MRM function does not know exists, no matter how well-designed the validation methodology itself might be on paper.
Bringing AI under an existing framework, not a new one
Institutions that succeed here extend their existing MRM policy to cover AI systems rather than standing up a separate, parallel process, because a parallel process tends to be under-resourced, poorly integrated with existing risk committees, and easy for a business line to route around. Extending the existing framework means AI systems get the same independent challenge, the same documentation standard, and the same escalation path that a traditional statistical model would, adapted only where the technology genuinely requires a different validation method.
In practice
- Add AI deployments to the existing model inventory rather than a parallel one
- Assign independent validation ownership outside the building team
- Trigger re-validation on provider version changes and on drift signals
- Extend existing MRM policy to cover AI rather than building a separate process
