SUNANDO ROY – On Banking, Finance and Society

From Model Risk to AI Risk: Supervisory Perspectives on Governing Advanced Analytics

Written by:

Sunandoroy

Models have long been recognised by supervisors as a critical source of financial risk. Quantitative tools influence credit approval, pricing, valuation, stress testing, and compliance decisions, often with direct implications for capital adequacy, consumer outcomes, and financial stability. Supervisory concern over these tools led to the development of formal model risk management (MRM) frameworks, intended to ensure that models are conceptually sound, appropriately validated, and governed with clear accountability.[bis]​

The growing adoption of artificial intelligence—particularly machine learning and generative models—has intensified these concerns. AI systems differ from traditional models in scale, opacity, adaptability, and dependence on large, continuously evolving datasets. These characteristics raise questions about whether existing supervisory frameworks can adequately capture AI‑related risks, or whether a distinct supervisory paradigm is required.[bis

Traditional Supervisory Foundations of Model Risk

The modern supervisory understanding of model risk is strongly shaped by SR 11‑7, issued by U.S. banking agencies and led by the Federal Reserve. SR 11‑7 defines a model broadly, encompassing not only quantitative algorithms but also the input data, assumptions, data transformations, and judgement embedded in decision frameworks. It establishes three core expectations: sound model development and implementation; independent and effective validation; and robust governance, policies, and oversight.[federalreserve]​

Although SR 11‑7 predates widespread use of machine learning, supervisors have consistently interpreted its scope expansively. AI systems—despite their technical novelty—are treated as models when they influence material decisions and therefore fall within the remit of model risk management expectations. This interpretation has been reinforced by the Office of the Comptroller of the Currency’s Model Risk Management Comptroller’s Handbook, which discusses AI and machine‑learning use cases and clarifies that such activities typically fall within existing model risk management expectations, while requiring enhanced controls to address explainability, data quality, and third‑party dependencies.[occ.treas]​

This continuity underscores an important supervisory principle: innovation does not reduce accountability. AI models are not exempt from validation or governance simply because their internal logic is complex or non‑linear.[ibm]​

Expanding Model Risk to Address AI Complexity

Recognising the limitations of legacy, capital‑centric MRM frameworks, several supervisors have modernised their guidance to explicitly accommodate advanced analytics. The Office of the Superintendent of Financial Institutions (OSFI) in Canada has updated Guideline E‑23 on Model Risk Management, which reframes model risk as an enterprise‑wide concern extending beyond regulatory capital models. OSFI’s revised approach clarifies that the guideline applies to all models supporting material decision‑making, explicitly referencing AI and machine‑learning models and highlighting associated financial, operational, legal, and reputational risks.[blakes]​

Similarly, the European Central Bank’s Guide to Internal Models—most recently revised with dedicated discussion of machine‑learning techniques—emphasises that all internal models, irrespective of methodology, are subject to governance, validation, and performance monitoring. While not an AI rulebook, this stance closes potential regulatory gaps by signalling that innovative methodologies cannot be used to circumvent existing supervisory expectations.[bankingsupervision.europa]​

These developments indicate a shift from model risk as a niche technical issue to model risk as a strategic governance concern, particularly where AI systems influence high‑impact decisions at scale.[torys]​

Emergence of AI‑Specific Supervisory Guidance

Some supervisors have moved beyond implicit inclusion of AI within MRM to issuing explicit AI‑focused risk guidance. The Monetary Authority of Singapore has published an Information Paper on Artificial Intelligence Model Risk Management, documenting observed good practices across the AI lifecycle following thematic reviews of financial institutions. The paper highlights risks such as data drift, model degradation, explainability failures, and over‑reliance on vendors, while reinforcing established supervisory expectations around governance, independent challenge, documentation, and post‑deployment monitoring.[allenandgledhill]​

Likewise, the Swiss Financial Market Supervisory Authority (FINMA) has issued Guidance 08/2024 – Governance and risk management when using artificial intelligence, which sets out supervisory expectations for institutions deploying AI. FINMA’s supervisory observations stress that boards and senior management must maintain sufficient understanding of AI systems to exercise effective oversight, reinforcing the principle that decision‑making responsibility cannot be delegated to algorithms or external vendors.[mll-news]​

These AI‑specific initiatives do not replace model risk frameworks; rather, they extend them, introducing new lenses through which traditional MRM principles are applied to AI architectures, data pipelines, and deployment practices.[bis]​

Global Supervisory and Standard‑Setting Perspectives

At the global level, the Bank for International Settlements and its Financial Stability Institute (FSI) have explored how AI challenges conventional supervisory assumptions. FSI Insights on regulating AI in the financial sector identify explainability constraints, model uncertainty, and correlated model behaviour as key vulnerabilities in AI‑driven systems. FSI’s work on AI explainability further analyses the limitations of current explainability tools and how supervisors might calibrate explainability expectations to different risk profiles and use cases.[bis]​

Traditional validation techniques may struggle to capture these risks, particularly where models adapt dynamically, are frequently re‑trained, or where multiple institutions rely on similar data sources, architectures, or third‑party vendors. BIS analysis also underscores a systemic dimension: AI may amplify herding, feedback loops, and procyclicality if widely adopted models respond similarly to market or macro‑financial stress, thereby blurring the boundary between micro‑prudential model risk and macro‑prudential financial stability concerns.[bis]​

From Validation to Stress: Reframing Supervisory Expectations

Across jurisdictions, a common supervisory insight is emerging. While traditional stress testing often assumes model stability under adverse conditions, AI risk management increasingly requires supervisors and firms to ask whether the model itself remains reliable and well‑behaved under stress. This reframing shifts attention from outputs alone to model behaviour, data integrity, governance effectiveness, and human oversight during extreme but plausible scenarios.[occ.treas]​

Supervisory discourse increasingly positions AI risk as a stress test of existing control frameworks. Where governance, validation, and accountability are weak, AI merely exposes these weaknesses more rapidly and at greater scale, given the speed, complexity, and interconnectedness of AI‑enabled decision‑making.[bis]​

To sum up, Supervisory approaches to AI risk reveal a consistent and pragmatic trajectory. Rather than creating entirely new regulatory silos, supervisors are embedding AI within established model risk management frameworks—while sharpening expectations to address opacity, adaptability, third‑party concentration, and systemic amplification. AI risk is therefore best understood not as a departure from model risk, but as its logical extension in an increasingly algorithm‑driven financial system.[federalreserve]​

The supervisory challenge lies not in defining AI as exceptional, but in ensuring that traditional principles—sound governance, independent challenge, transparency, and accountability—remain effective when models learn, evolve, and operate at unprecedented scale.[blakes]​

References

Discover more from SUNANDO ROY – On Banking, Finance and Society

Subscribe to get the latest posts sent to your email.

Leave a Reply

Latest Articles

Previous:
Next: