AI Model Risk Management
AI model risk management (MRM) is the discipline of identifying, measuring and controlling the risks of AI models across their lifecycle: validation before deployment, monitoring in production, documentation for review, and clear accountability for outcomes. SR 11-7 and its successor SR 26-2 anchor it in US banking.
What AI model risk management means
Model risk management predates generative AI — banks have validated credit models for decades — and its vocabulary (validation, effective challenge, three lines of defense) is what regulators expect. Generative and agentic AI stretch the discipline in two directions. Generative models resist traditional validation because outputs are non-deterministic and evaluation is statistical rather than deterministic. And agents add a new risk object entirely: the risk is no longer only "the model is wrong" but "the model-driven system took an action" — which brings operational risk, third-party risk and business-process controls into scope. The practical 2026 picture: SR 26-2 (April 2026) supersedes SR 11-7 and leaves agentic AI formally out of scope while regulators prepare an RFI; NAIC has issued its model bulletin for insurers; the EU AI Act imposes conformity duties on high-risk systems. MRM teams that extend their inventories and validation practice to agents now will find the coming supervisory expectations familiar rather than novel.
Frequently asked questions
What is AI model risk management?
The lifecycle discipline for AI model risk: independent validation before deployment, ongoing monitoring, documentation that supports review and effective challenge, and clear ownership of outcomes. In US banking it is anchored by SR 11-7 and now SR 26-2.
How does agentic AI change model risk management?
It adds a second risk object. Model risk asks "is the model wrong?" Agent risk asks "what did the model-driven system do?" — which implicates identity, permissions, approvals, evidence and stop controls. MRM teams should extend inventories to agents and coordinate with operational risk, rather than treating agents as just another model.