# Model risk management

> What model risk management means, where it comes from, what an inventory and independent validation are, and why the same structure suits AI systems.

- Web page: https://www.alesanalytics.com/explainers/model-risk-management
- Markdown: https://www.alesanalytics.com/explainers/model-risk-management.md
- Last updated: 2026-09-18
- Publisher: Ales Analytics

The discipline regulated firms use to keep models honest, applied to AI.

## In one paragraph

Model risk management is the discipline regulated firms use to make sure a model is doing what it is meant to: an inventory of every model in use, independent checking by people who did not build it, and clear ownership across its life from development to retirement. It grew out of banking supervision, but the same structure suits AI systems well, because the underlying question, is this model right, and who is checking, is the same one.

## Who it applies to

Historically, banks and other regulated financial firms, where supervisors expect a documented model risk management programme. The reference text is SR 11-7, guidance issued jointly by the Federal Reserve and the Office of the Comptroller of the Currency on 4 April 2011 and still current. Supervisors increasingly read this guidance as covering AI and machine-learning models alongside the statistical models it was originally written for, and other supervisors outside US banking hold comparable expectations of the firms they regulate.

## What it asks for

- A firm-wide inventory of every model in use, with its purpose and its owner recorded.
- A risk tier assigned to each model, so the depth of checking matches how much is riding on it.
- Independent validation carried out by people who did not build the model, before it is deployed.
- Periodic revalidation after deployment, rather than a one-off check at launch.
- Coverage across the whole lifecycle, from development through deployment to eventual retirement.
- In the EU financial sector, the Digital Operational Resilience Act adds ICT risk management, incident reporting, resilience testing, and oversight of critical third-party providers, a category that includes cloud and AI vendors.

## What it looks like in practice

A firm has run a credit scoring model for years under a model risk programme, and now wants to add an AI system that drafts customer responses. Extending the existing inventory and validation process to the new system, rather than treating it as a separate, ungoverned tool, is usually the fastest way to get it into use with the checking a supervisor would expect to see.

## Where it stands now

SR 11-7 was issued on 4 April 2011 and remains the current reference text in US banking supervision. The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied in the EU financial sector since 17 January 2025. Dates change; the official text linked below is the authority.

## How this connects to our work

For organisations in regulated sectors, the way every build is run covers much of the same ground as a model risk management programme: an inventory, checking against a fixed set of examples, and evidence that each system is monitored after launch rather than assumed to be working. See [evaluation in CI and production](https://www.alesanalytics.com/docs/evaluation-in-ci-and-production).

## Read the original

1. [SR 11-7, Supervisory Guidance on Model Risk Management](https://www.federalreserve.gov/supervisionreg/srletters/sr1107.htm). Federal Reserve and OCC, 2011. The reference text for model inventories and independent validation.
2. [Regulation (EU) 2022/2554, Digital Operational Resilience Act](https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng). European Union, 2022. ICT resilience rules for EU financial entities, applicable since January 2025.

## Contact

solutions@alesanalytics.com, or https://www.alesanalytics.com/contact.

- Every page as Markdown: https://www.alesanalytics.com/llms.txt