What does PRA SS1/23 say about AI in banking?

What are the key points of PRA SS1/23?

• Five principles: (1) model identification and model risk classification, (2) governance, (3) model development, implementation and use, (4) independent model validation, (5) model risk mitigants.
• Scope is all models informing business decisions, regardless of technology, whether in-house or vendor-supplied, including models used for financial reporting.
• Sub-principle requires firms to identify and manage the risks of AI in modelling techniques such as machine learning to the extent that it applies to models generally.
• Accountability for the overall MRM framework must be allocated to the most appropriate SMF holder under the Senior Managers regime.
• Effectiveness of MRM for financial reporting must be reported to the audit committee.
• Proportionate implementation across model tiers and across firms; formal scope is internal-model banks, with others expected to apply it proportionately.
• In October 2025 the PRA held CRO roundtables with 21 firms on applying SS1/23 to AI/ML, covering risk appetite, model tiering, explainability, overfitting, validation and monitoring.

What did PRA SS1/23 change for banks?

Before SS1/23 the PRA had no consolidated model-risk standard; UK banks often borrowed SR 11-7. SS1/23 made model risk a standalone discipline with named senior-manager accountability, and by deliberately covering AI/ML and vendor models it became the main channel through which the PRA supervises AI in banks. The BoE/PRA told government in April 2026 they intend to build on it further in 2026 using supervisory insights on good practice.