Definition
Model risk management is well established in banking. In the US, the Federal Reserve's SR 11-7 guidance (2011) set the core practices: sound development, independent validation, ongoing monitoring and governance of every model, with an inventory and clear ownership. In April 2026 the Federal Reserve, OCC and FDIC replaced it with revised guidance, SR 26-2, which takes a more risk-based approach, tailored to each bank's model risk profile.
Generative AI widens the problem: models are bought rather than built, change when the provider updates them, and are used for open-ended tasks. Many firms are extending their model risk frameworks to cover AI vendors, prompts, agents and their evaluation.