Model risk management in banking: the framework, the rules, and where AI fits.

What is the model risk management framework for US banks?

Since April 17, 2026 it is one interagency text issued under three numbers: the Federal Reserve's SR 26-2, OCC Bulletin 2026-13 and FDIC FIL-15-2026. It replaced the 2011 guidance (SR 11-7 / OCC Bulletin 2011-12) and keeps its architecture: sound model development and use, independent validation and ongoing monitoring, and governance and controls, with a separate section on vendor and other third-party products. What changed is the footing. The guidance is risk-based and scaled to model materiality, is expected to be most relevant above $30 billion in total assets, defines a model as a 'complex' quantitative method, and says non-compliance will not by itself draw supervisory criticism.

What goes in a model inventory, and how are models tiered?

A model inventory is the firm-wide record of every model in use or under development, with enough information to understand each model's risk and the bank's model risk in aggregate. The 2011 guidance listed what it should hold: purpose and products, actual and expected use, restrictions, inputs and outputs, responsible individuals, and the dates of completed and planned validation. Tiering decides how much scrutiny each entry gets. SR 26-2 builds it on materiality, which it defines as model exposure together with model purpose: models a bank deems immaterial may only need identifying and monitoring, while higher-materiality models 'warrant more comprehensive and rigorous oversight'. The UK's SS1/23 makes model identification and risk classification its first principle.

What does model validation involve?

Validation is the set of activities that verify a model performs as expected for its design objectives and business use. Under both the 2011 and 2026 US guidance it has three components: conceptual soundness (design, assumptions, data and developmental testing), outcomes analysis (comparing outputs with real-world outcomes, including back-testing) and ongoing monitoring (whether the model still performs as products, data and markets change). SR 26-2 says validation generally occurs before first use, that its timing and depth vary with purpose, methodology and materiality, and that its quality 'depends on the rigor and effectiveness of the review rather than on organizational structure'. Effective challenge needs expertise, independence and the standing to effect change.

What are the three lines of defense in model risk management?

The three lines of defense assign model risk to three groups: the business units that own, develop and use models (first line), an independent model risk management and validation function that controls that risk and provides effective challenge (second line), and internal audit, which tests whether the whole framework works (third line). US model risk guidance does not use the phrase. SR 11-7 divides the roles among 'ownership, controls, and compliance' and gives internal audit its own section; the OCC's heightened standards for large banks name front line units, independent risk management and internal audit; and the Basel Committee's corporate governance principles describe business units, risk management and internal audit as 'the three lines of defence'.

SOURCES: SR 11-7 attachment: Supervisory Guidance on Model Risk Management (PDF) ↗ · SR 26-2 attachment: revised guidance (PDF) ↗ · OCC heightened standards, 12 CFR Part 30, Appendix D ↗ · BCBS, Corporate governance principles for banks (2015) ↗

How does model risk management apply to AI, machine learning and generative AI?

In the US the line runs between predictive and generative systems. SR 26-2 states that its principles apply to 'traditional statistical and quantitative models and non-generative, non-agentic AI models', so a machine-learning credit, fraud or AML model is validated like any other model, in proportion to its materiality. Generative AI and agentic AI models are 'novel and rapidly evolving' and 'not within the scope of this guidance'; a bank's broader risk management and governance practices decide their controls, and the agencies plan a request for information on model risk management and banks' use of AI. The UK runs the other way: the PRA's SS1/23 keeps AI and machine learning inside model risk management.

What do examiners ask to see in a model risk management review?

The evidence trail the guidance describes: a model inventory with owners and materiality tiers; board-approved policies that define what a model is and who does what; development documentation that an outsider could follow; validation reports covering conceptual soundness, outcomes analysis and ongoing monitoring; the record of issues, exceptions and limits on model use; due diligence and performance evidence for vendor models; and internal audit's assessment of the framework. The 2026 guidance says it sets no enforceable standards and that non-compliance will not by itself draw supervisory criticism, so the conversation is about whether practices are sound for the bank's risk, not about a checklist.

SOURCES: SR 26-2 attachment: revised guidance (PDF) ↗ · SR 11-7 attachment (PDF) ↗ · OCC Bulletin 2026-13 ↗

Which model risk documents has each authority published?

Which of the 100 largest US banks have disclosed model risk work on AI?

6 of the 100 bank pages on this site record a model-risk activity tied to AI. Each links to the bank's page, where the claim is sourced.