PRA Supervisory Statement 1/23, 'Model risk management principles for banks', was published with Policy Statement 6/23 on 17 May 2023 and has applied since 17 May 2024 to UK banks, building societies and PRA-designated investment firms with internal-model permission for regulatory capital. It sets five principles — (1) model identification and model risk classification, (2) governance, (3) model development, implementation and use, (4) independent model validation and (5) model risk mitigants — broken into 23 sub-principles, and it covers every model that informs a business decision, in-house or vendor-supplied, regardless of technology. The statement never uses the words 'artificial intelligence' or 'machine learning'. It reaches AI through Principle 1.3(c), which lets the complexity rating of 'newly advanced approaches or technologies' weigh unstructured data, interpretability, explainability, transparency and bias, and through Principle 3.3(c) and footnote 19, which require testing of material changes in dynamic models that adapt, recalibrate or change autonomously, including automatic recalculation of parameters and hyperparameters. Accountability for the whole framework sits with a named Senior Management Function holder, firms self-assess at least annually, and the 23 April 2026 amendments (LIAF01/26) confirmed the expectations are not conditions for internal-model approval and gave newly permitted firms 12 months to comply. Barclays, Lloyds, HSBC, NatWest and Standard Chartered all disclose AI governance built on it.
TRACKED DOCUMENTS: PRA SS1/23 · PRA AI/ML model-risk roundtable (Nov 2025)
What is PRA SS1/23 and who must comply?
SS1/23 is the Prudential Regulation Authority’s model risk management standard and the UK’s closest counterpart to the US interagency guidance that began as SR 11-7. The PRA consulted on it as CP6/22 on 21 June 2022, received responses until 21 October 2022, and published the final statement with PS6/23 on 17 May 2023. Paragraph 1.5 sets the commencement date: the policy came into effect on Friday 17 May 2024. Paragraph 1.4 explains the design: five high-level principles covering all elements of the model lifecycle, with the stated outcome that firms treat MRM ‘as a risk discipline in its own right’.
The formal scope is narrower than the title suggests. Paragraph 1.2 makes the statement relevant to UK-incorporated banks, building societies and PRA-designated investment firms with internal-model approval to calculate regulatory capital, meaning IRB for credit risk, IMA for market risk or IMM for counterparty credit risk. The expectations do not apply to firms without such permission or to third-country branches, though the PRA says those firms ‘may find the proposed principles useful, and are welcome to consider them’. Credit unions, insurers and reinsurers are out of scope. Within scope, however, the reach is wide: paragraph 1.3 covers ‘all models, developed in-house or externally, including vendor models, and models used for financial reporting purposes’, and the principles complement rather than replace the model-specific expectations that already exist for IRB, IMA and stress-test models.
Two things make SS1/23 distinctive among model-risk standards. It is personal: Principle 2.2 requires the firm to allocate responsibility for the overall MRM framework to the most appropriate Senior Management Function holder, and paragraph 1.8 makes that SMF responsible for remediation plans. And it is self-assessed: paragraphs 1.6 and 1.7 required an initial self-assessment against the principles before the commencement date, with remediation plans shared with the board, and require the self-assessment to be updated at least annually thereafter. Firms need not send either to the PRA routinely but must provide them on request. Since 23 April 2026, under the low-impact amendments tracked here as LIAF01/26, the expectations are explicitly not conditions for internal-model approval, a firm that first receives an internal-model permission has 12 months from the grant to comply (a rule paragraph 1.9 already contained for firms permitted after May 2023), and internal-model firms assess stress-test models against SS1/23 rather than SS3/18 alone. Our document page records those amendments; our model risk management hub sets the statement beside the US, euro-area and Basel documents.
What are the five principles of SS1/23?
The five principles follow the lifecycle of a model: decide what counts as a model and how risky it is, govern the programme, build and use the model properly, validate it independently, and have mitigants ready for when it is found wanting. The statement numbers 23 sub-principles beneath them, and each sub-principle has lettered paragraphs with the detailed expectations. The figure gives the structure; the table that follows gives the expectations and the evidence a firm would hold for each.
Principle 1, model identification and model risk classification, is the foundation: a firm-wide definition of a model (1.1), a complete inventory (1.2) and a risk-based tiering of every model by materiality and complexity (1.3). Principle 2, governance, asks for a board that promotes an MRM culture and sets model risk appetite (2.1), an accountable SMF (2.2), lifecycle policies and procedures including audit-committee reporting for financial-reporting models (2.3), clear roles (2.4), internal audit coverage of the framework (2.5) and vendor-model expectations that mirror SS2/21 on outsourcing (2.6). Principle 3, development, implementation and use, covers purpose and design (3.1), data (3.2), development testing including of dynamic models (3.3), adjustments and expert judgement (3.4), documentation (3.5) and supporting systems (3.6). Principle 4, independent validation, sets up the validation function (4.1) and its four jobs: independent review before use (4.2), process verification (4.3), performance monitoring (4.4) and periodic revalidation (4.5). Principle 5, model risk mitigants, governs post-model adjustments (5.1), restrictions on model use (5.2) and exceptions and escalations (5.3).
What does each sub-principle expect, and what evidence satisfies it?
The expectations column paraphrases the statement; the evidence column is what a validation or audit team would file, and is our reading rather than the PRA’s. Paragraph references are to the May 2023 text.
| Principle | Sub-principle | Expectation (paraphrased from SS1/23) | Evidence a firm holds |
|---|---|---|---|
| 1 — Identification and classification | 1.1 Model definition | Adopt the SS1/23 definition: a quantitative method, system or approach that applies statistical, economic, financial or mathematical theories, techniques and assumptions to process input data into output; consider applying the framework to material, complex deterministic rules too (1.1(b)) | Board-approved model definition in the MRM policy; a documented decision log for borderline cases (rules engines, vendor scores, generative tools that inform decisions) |
| 1.2 Model inventory | A complete, firm-wide inventory of all models in use, under development or recently retired, with owners, users, purpose, tier and validation status | The inventory extract with completeness attestations from business lines; reconciliation to the IT asset register and the AI use-case register | |
| 1.3 Model tiering | A consistent, firm-wide, risk-based materiality and complexity rating for every model, with complexity factors that may include alternative or unstructured data and interpretability, explainability, transparency and bias for newly advanced approaches (1.3(c)) | Tiering methodology, the tier of every model in the inventory, independent review of the tiering approach (1.3(d)) and reassessment of each tier at validation (1.3(e)) | |
| 2 — Governance | 2.1 Board responsibilities | The board promotes an MRM culture, sets model risk appetite and approves the MRM policy | Risk appetite statement with model-risk metrics; board minutes approving the policy; regular model-risk reporting to the board |
| 2.2 SMF accountability | Responsibility for the overall MRM framework allocated to the most appropriate Senior Management Function holder(s), who owns remediation plans (1.8) | The SMF's statement of responsibilities naming MRM; evidence the SMF receives self-assessment and remediation reporting | |
| 2.3 Policies and procedures | Documented policies covering the whole lifecycle, proportionate to tier, including reporting on MRM effectiveness for financial-reporting models to the audit committee | The MRM policy and standards set; audit-committee papers on financial-reporting model risk | |
| 2.4 Roles and responsibilities | Clear owners, developers, users, validators and approvers for each model, with authority commensurate with tier | RACI per model in the inventory; approval authority matrix by tier | |
| 2.5 Internal audit | Internal audit assesses the overall effectiveness of the MRM framework and the independence of validation | Audit plan coverage and findings on MRM; tracking of audit actions to closure | |
| 2.6 Vendor and external models | Boards remain responsible under SS2/21; vendor models validated to the same standard as in-house ones, vendor data and assumptions verified, the firm's own use validated and monitored | Vendor model validation reports; contractual rights to documentation and testing; contingency plans for vendor withdrawal | |
| 3 — Development, implementation and use | 3.1 Purpose and design | Documented purpose, design and methodology choices, with limitations and assumptions | Model design document and the record of methodology alternatives considered |
| 3.2 Use of data | Data quality, relevance, representativeness and suitability assessed and documented | Data lineage and quality assessment; representativeness analysis against the portfolio or customer base | |
| 3.3 Development testing | Testing before use and for material changes, including changes over time in dynamic models that adapt, recalibrate or otherwise change autonomously (3.3(c)); parallel outcomes analysis | Test plan and results; change-control records for dynamic or self-updating models with before/after output comparison | |
| 3.4 Adjustments and expert judgement | Expert judgement and adjustments made in development are justified, documented and reviewed | Adjustment register with rationale and sign-off | |
| 3.5 Development documentation | Documentation detailed enough for an independent party to understand and replicate the model | The development document, versioned, with code and data references | |
| 3.6 Supporting systems | Systems and infrastructure supporting the model are controlled and tested | Implementation testing evidence; change management records; access controls | |
| 4 — Independent validation | 4.1 Validation function | An objective, unbiased and critical opinion on suitability and soundness, system design, data and reporting, with recommendations to the approval authority | Validation charter and reporting line; validation reports with explicit recommendations |
| 4.2 Independent review | All models reviewed for conceptual soundness, development evidence and suitability, before use and proportionate to tier | Pre-implementation validation report per model, covering all components from inputs to reports | |
| 4.3 Process verification | Verification that the model is implemented and used as approved | Implementation and use verification records; production-versus-approved reconciliation | |
| 4.4 Performance monitoring | Ongoing monitoring against thresholds that trigger review, recalibration or redevelopment | Monitoring dashboards with defined triggers; breach log and actions | |
| 4.5 Periodic revalidation | Revalidation at a frequency set by tier and by material change | Revalidation schedule in the inventory; completed revalidation reports | |
| 5 — Model risk mitigants | 5.1 Post-model adjustments | A governed process for PMAs and overlays with ownership, approval, documentation and review | PMA register with rationale, approver, expiry and reporting to senior management |
| 5.2 Restrictions on use | Restrictions or prohibitions where significant deficiencies or performance breaches are found, documented and tracked in the inventory | Inventory flags for restricted models; communications to users; remediation tracking | |
| 5.3 Exceptions and escalations | Formally approved exception policies for material models, with temporary exceptions, tolerance limits, controls and prompt escalation to owners, users, validators and senior management | Exception register; escalation records; evidence of alternative models or heightened review while an exception is open |
How does model tiering work under SS1/23?
Tiering is the mechanism that keeps a technology-neutral scope workable. Principle 1.3 says risk-based model tiering ‘should be used to prioritise validation activities and other risk controls through the model lifecycle’, and 1.3(a) asks for a consistent, firm-wide approach that assigns a materiality and a complexity rating to each model. SS1/23 does not prescribe how many tiers a firm should have or where the boundaries fall; that is for the firm’s policy. What it does prescribe is the inputs and the governance of the rating.
| Dimension | Factors the statement names | Additional factors | Note |
|---|---|---|---|
| Materiality (1.3(b)) | Quantitative size measures: exposure, book or market value, number of customers the model applies to | Qualitative factors: purpose, importance to business decisions, potential impact on solvency and financial performance | Firms set their own scales; SS1/23 does not prescribe a number of tiers |
| Complexity (1.3(c)) | Nature and quality of input data; choice of methodology and assumptions; requirements and integrity of implementation; frequency and extent of use | Where needed, for newly advanced approaches or technologies: alternative and unstructured data; interpretability, explainability, transparency and potential for designer or data bias | This is where an ML or generative model moves up a tier without the text naming AI |
| Governance of tiering (1.3(d)–(e)) | The firm-wide approach is periodically validated or independently reviewed, including the relevance and availability of tiering information | Each model's tier is independently reassessed at validation and revalidation | Tier accuracy is itself examinable |
| What the tier drives | Depth of development documentation (3.5), pre-use validation rigour (4.2), monitoring frequency (4.4) and revalidation frequency (4.5) | Approval authority (2.4), exception tolerances (5.3) and the intensity of vendor-model validation (2.6) | Proportionality is the mechanism that keeps a 'models regardless of technology' scope workable |
The practical consequence for AI is that tier assignments move. A gradient-boosted fraud model on structured transaction data is complex by methodology but may be modest in materiality; the same model fed with unstructured device telemetry, or a generative assistant that drafts credit memos read by underwriters, picks up the 1.3(c)(i) and (ii) factors and climbs. The PRA’s October 2025 roundtables with 21 firms, summarised in its November 2025 note, found exactly this inconsistency: several firms were applying core SS1/23 expectations unevenly where AI introduced opacity, uncertainty and faster change, and the PRA’s slides set out its thinking on risk appetite, tiering, explainability, overfitting, validation and monitoring. The 1.3(d) and (e) requirements that the tiering approach be independently reviewed and that each tier be reassessed at validation are what make a mis-tiered AI model a finding in its own right.
What does SS1/23 say about AI and machine learning?
Nothing by name. The May 2023 PDF contains zero occurrences of ‘artificial intelligence’ or ‘machine learning’, and the compare page on this site notes the same for the April 2026 version. The Bank of England’s landing page for the statement does summarise one element as a sub-principle on AI in modelling techniques such as machine learning, but that wording belongs to the page, not the statement. What the statement does instead is define ‘model’ broadly enough to capture any AI system that informs a decision, and then place the AI-specific concerns inside two ordinary principles: the complexity factors of tiering and the testing of dynamic models. The table quotes the passages with their paragraph numbers.
| Paragraph | What the text says | What it means for an AI or ML model |
|---|---|---|
| 1.1(a) Model definition | 'A model is a quantitative method, system, or approach that applies statistical, economic, financial, or mathematical theories, techniques, and assumptions to process input data into output.' Inputs may be quantitative, qualitative or expert-judgement based; outputs quantitative or qualitative. | Any ML model, vendor scoring engine or generative tool whose output informs a business decision is a model. The question for a bank is not whether AI is in scope but which tier it lands in. |
| 1.1(b)–(c) Deterministic methods | Material, complex deterministic rules or algorithms not classified as models should be considered for the relevant aspects of the MRM framework; others need sound, documented management controls. | Rules engines, decision trees and agent guardrails that are deterministic are not automatically models but are not outside governance either. |
| 1.3(c) Complexity factors | 'Where necessary (in particular with the use of newly advanced approaches or technologies), the complexity assessment may also consider risk factors related to: (i) the use of alternative and unstructured data, and (ii) measures of a model's interpretability, explainability, transparency, and the potential for designer or data bias to be present.' | The only place the statement reaches toward AI by description. The Bank of England's landing page summarises it as a sub-principle on AI in modelling techniques such as machine learning; the statement itself does not use those words. |
| 3.3(c) Dynamic models | Development testing 'should also be conducted for material model changes, including material changes over a period of time in dynamic models (ie models able to adapt, recalibrate, or otherwise change autonomously in response to new inputs), and should include a comparison of the model output prior to the change and the corresponding output following the change to actual observations and outcomes (ie parallel outcomes analysis).' | Online-learning fraud models, auto-retrained credit models and any system whose parameters move without a release are covered; the test is before-and-after output comparison against real outcomes. |
| Footnote 19 | 'Including where parameters and/or hyperparameters are automatically recalculated over time.' | Confirms that automatic retraining is a material change for testing purposes. |
| 2.6(b) Vendor models | Firms should 'satisfy themselves that the vendor models have been validated to the same standards as their own internal MRM expectations', verify vendor data and assumptions, and validate their own use with ongoing monitoring. | Foundation models consumed through vendors fall here; the bank validates its use even where it cannot validate the model. |
| 4.2(a) Independent review | All models get an independent review covering all components, conceptual soundness and the relevance and completeness of development data for the portfolios, products or customers the model is used for. | For generative systems the PRA's own February 2026 summary records that traditional 'inputs to outputs' validation will not be sustainable, so outcome testing and monitoring take its place. |
The PRA’s later material fills in the application. The roundtable note of 24 November 2025 records the CRO discussions of 20 and 22 October 2025 on applying the principles to AI and ML: risk appetite, model tiering, explainability, overfitting, validation and monitoring. The Bank’s summary of its wider AI roundtables, published 16 February 2026, records that firms called SS1/23 ‘pragmatic in enabling responsible AI adoption’, asked for no AI-specific rules, and said that the traditional ‘inputs to outputs’ understanding at the heart of validation would not be sustainable for generative and agentic systems, so risk management must move toward outcome testing, monitoring and guardrails. The PRA and the Bank told government in April 2026 that they intend to build on SS1/23 during 2026 using supervisory insights on good practice. The direction is therefore to apply the statement, not to replace it; the earlier FS2/23 feedback statement had already recorded industry consensus against a regulatory definition of AI.
For a firm this resolves into four questions per AI system. Is it a model under 1.1, or a deterministic method under 1.1(b)? What tier does it take once the 1.3(c) factors are weighed? If it retrains or recalibrates on its own, how is the 3.3(c) parallel outcomes analysis run and at what frequency? And if it is a vendor foundation model, how does the firm satisfy 2.6(b) by validating its own use where it cannot validate the model? Our AI governance in banking hub shows how UK and US banks have answered those questions in their disclosures; the US equivalent framework for the enterprise layer is the NIST AI RMF, covered in our NIST AI RMF guide.
What is the SS1/23 timeline from CP6/22 to the 2026 amendments?
The dates that matter for compliance are three. 17 May 2023 is when the expectations became known and the self-assessment clock started. 17 May 2024 is when they applied, by which date paragraph 1.6 expected an initial self-assessment and, where relevant, remediation plans; paragraph 1.7 then requires the self-assessment to be updated at least annually and shared with the board along with remediation progress. 23 April 2026 is the amendment date, after which the expectations are expressly not a condition of internal-model approval and the 12-month window for newly permitted firms is restated. Firms permitted before May 2023 have been expected to comply since May 2024 and should now be on at least their second annual self-assessment, available to the PRA on request under paragraph 1.8.
How does SS1/23 map to SR 11-7 and SR 26-2?
SS1/23 and the US guidance share a lineage: the PRA’s definition of a model is recognisably SR 11-7’s, and development, validation and governance appear in both. The differences are in who is covered, who is personally accountable, how AI is treated and whether the firm must self-assess. The short table below summarises them; the full side-by-side with sources is on PRA SS1/23 vs SR 26-2, and the US change of April 2026 is explained on SR 11-7 vs SR 26-2.
| Dimension | PRA SS1/23 (UK) | SR 11-7 → SR 26-2 (US) |
|---|---|---|
| Who it applies to | UK banks, building societies and PRA-designated investment firms with internal-model (IRB, IMA, IMM) permission; others 'may find the principles useful' | All US banking organisations, most relevant to those with material model use |
| Scope of 'model' | All models informing business decisions, in-house or vendor, including financial reporting, regardless of technology | Quantitative methods and approaches that apply statistical, economic, financial or mathematical theories; ML models explicitly in scope since April 2026 |
| Generative and agentic AI | Not named; reached through 1.3(c) tiering factors and 3.3(c) dynamic-model testing | Explicitly left outside formal model-risk scope and to the bank's broader risk programmes |
| Personal accountability | Named SMF holder(s) accountable for the MRM framework (2.2) | Board and senior management oversight; no named individual regime |
| Self-assessment | Initial self-assessment and remediation plans before 17 May 2024; updated at least annually; available to the PRA on request (1.6–1.8) | No self-assessment requirement; examined through the supervisory cycle |
| Financial reporting | MRM effectiveness for financial-reporting models reported to the audit committee | Not specifically addressed |
| Vendor models | Validated to the same standard as in-house; firm validates its own use (2.6) | Third-party models subject to the same validation and monitoring expectations |
| Structure | Five principles, 23 sub-principles | Guidance in sections on development, validation and governance with an attachment |
The AI row is the one that drives programme design on each side of the Atlantic. In the UK, generative and agentic systems are inside the model risk framework by definition and get proportionate treatment through tiering. In the US, SR 26-2 keeps machine-learning models inside model risk and places generative and agentic AI outside formal validation scope, which pushes US banks to build an enterprise AI governance layer, typically on the NIST AI RMF, beside model risk management. A group supervised in both jurisdictions, such as Barclays with Barclays US or HSBC with HSBC USA, ends up running one inventory with two tiering overlays.
Which banks say their AI governance is built on SS1/23?
The bank profiles on this site record what each institution has disclosed. For the PRA-supervised groups the pattern is consistent: the model risk framework was updated to SS1/23 in 2024 or 2025, AI validation was added to it rather than built beside it, and an AI-specific council or committee sits inside the governance principle.
| Bank | What it discloses | Status | Source |
|---|---|---|---|
| Barclays | Updated its model risk framework in 2025 to meet the PRA's MRM principles, introduced an AI Standard, developed an approach to AI validation including generative AI, and extended the framework to data and technology risks; a Head of AI/ML Risk reports into Model Risk Management and chairs the Group AI Governance Council | In production | 2025 annual report on Form 20-F |
| Lloyds Banking Group | Board risk committee oversaw embedding of the SS1/23 principles and AI model validation; use cases overseen by a Data and AI Ethics Committee and held in a central model and use-case inventory; board risk committee deep dive on generative and agentic AI | In production | 2025 annual report |
| HSBC | Novel AI use cases go through a governance review before pilot and are approved by a committee of senior executives; AI Review Councils embedded across the bank in H1 2025 | In production | HSBC AI and AI-risk pages |
| NatWest | Every AI use case triaged through the AIDE process; an AI Steering Committee reviews ambition and progress; the Board Risk Committee agreed AI risks would be reported in a consolidated AI dashboard in 2026 | In production | 2025 annual report |
| Standard Chartered | Responsible AI Council assesses each model against fairness, ethics, transparency, performance, cyber and privacy principles and decides approval; AI Safety Council evaluates solutions before use with tiered assessment; Audit Committee receives twice-yearly responsible-AI reporting | In production | 2025 annual report; group interviews |
| Santander | Model-risk scope extended to AI systems and EU AI Act compliance; a bank-wide evaluation framework scores performance, behaviour, safety and fairness and monitors production for drift | In production / rolling out | 2025 annual report; evaluation framework announcement 2026 |
Data as of 2026-10-15 · 140 bank profiles · 238 tracked documents. Each bank link opens the profile with the dated sources behind the row; the two Barclays entries come from its 2025 Form 20-F, which also discloses a risk factor on generative and agentic AI.
What are the five principles of PRA SS1/23?
Model identification and model risk classification (Principle 1); governance (2); model development, implementation and use (3); independent model validation (4); and model risk mitigants (5). They are broken into 23 numbered sub-principles, from 1.1 model definition to 5.3 exceptions and escalations.
When did SS1/23 come into force?
17 May 2024, one year after publication on 17 May 2023 with PS6/23 (paragraph 1.5). Firms were expected to complete an initial self-assessment and remediation plans before that date and to update the self-assessment at least annually afterwards.
Does SS1/23 apply to AI and machine learning models?
Yes, by definition rather than by name. The text never uses the words AI or machine learning, but its model definition covers any quantitative method that processes input data into output used for business decisions, regardless of technology. Principle 1.3(c) lets tiering weigh unstructured data, interpretability, explainability, transparency and bias for newly advanced approaches, and Principle 3.3(c) with footnote 19 requires testing of dynamic models that adapt, recalibrate or change autonomously, including automatic recalculation of parameters.
Which firms must comply with SS1/23?
UK-incorporated banks, building societies and PRA-designated investment firms with internal-model approval for regulatory capital (IRB, IMA or IMM). Firms without such permission, third-country branches, credit unions and insurers are outside the expectations, though the PRA says other firms may find the principles useful.
Who is accountable for model risk under SS1/23?
A named Senior Management Function holder. Principle 2.2 requires responsibility for the overall MRM framework to be allocated to the most appropriate SMF(s), and paragraph 1.8 makes that SMF responsible for ensuring remediation plans are in place. The board approves the MRM policy and sets model risk appetite under Principle 2.1.
How many model tiers does SS1/23 require?
It does not set a number. Principle 1.3 requires a consistent, firm-wide approach that assigns a materiality rating and a complexity rating to every model and uses the result to set the intensity of validation and other controls; the number of tiers and their boundaries are for the firm's policy.
What changed in SS1/23 in April 2026?
The 23 April 2026 low-impact amendments (LIAF01/26) clarified that the SS1/23 expectations are not conditions for internal-model approval, restated that a firm first receiving an internal-model permission has 12 months from the grant to comply, and made internal-model firms assess stress-test models against SS1/23 rather than SS3/18 alone.
How does SS1/23 differ from SR 11-7?
Both are principles-based model risk standards covering development, validation and governance. SS1/23 applies only to internal-model firms but reaches all models regardless of technology, names an accountable SMF, requires annual self-assessment and audit-committee reporting on financial-reporting models, and covers AI through tiering and dynamic-model testing. The US guidance, now SR 26-2, applies to all banking organisations, has no named-individual regime, and leaves generative and agentic AI outside formal model-risk scope.
- PRA SS1/23 — Model risk management principles for banks (publication page, current version) — Bank of England / PRA, Apr 23, 2026 (bankofengland.co.uk)
- PRA SS1/23 — May 2023 PDF (paragraph references in this guide) — Bank of England / PRA, May 17, 2023 (bankofengland.co.uk)
- PRA CP6/22 — Model risk management principles for banks (consultation) — Bank of England / PRA, Jun 21, 2022 (bankofengland.co.uk)
- PRA — Model risk management roundtable on artificial intelligence and machine learning technologies — Bank of England / PRA, Nov 24, 2025 (bankofengland.co.uk)
- Bank of England — Summary of AI roundtables — Bank of England / PRA, Feb 16, 2026 (bankofengland.co.uk)
- PRA — Low-impact amendments finalisation, April 2026 (LIAF01/26) — Bank of England / PRA, Apr 23, 2026 (bankofengland.co.uk)
- Federal Reserve SR 26-2 — Revised Guidance on Model Risk Management — Federal Reserve, Apr 17, 2026 (federalreserve.gov)
When this rule moves, the next morning's brief says so
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am ET · free
plus every tracker, bank and agent page update, the morning after · leave any morning