AI in Finance & Banking · AI in Bank Risk Management

What Is Model Risk and Why Do Regulators Worry About AI Models in Banking?

Model risk is the possibility that a bank suffers losses or makes poor decisions because a financial model, including an AI model, is flawed, misused, or misunderstood, and regulators worry about it in AI specifically because complex machine learning models can be harder to interpret, validate, and monitor than traditional statistical models.

Key takeaways

Model risk refers to the potential for adverse consequences from decisions based on models that are incorrect, poorly designed, or used inappropriately for the situation.
U.S. bank regulators, including the OCC and Federal Reserve, have long-standing model risk management guidance that applies to AI models as much as it does to traditional statistical models.
AI models, particularly complex machine learning systems, can be harder to interpret and validate than simpler traditional models, which adds a layer of difficulty to standard model risk management practices.
Regulators expect banks to have robust processes for validating, monitoring, and governing AI models throughout their lifecycle, not just at initial deployment.

Defining Model Risk

Model risk refers to the potential for a bank to suffer financial losses, make poor business decisions, or face regulatory or reputational consequences because a model it relies on is flawed, was built on incorrect assumptions, is used outside the context it was designed for, or simply performs worse than expected once deployed in the real world. This concept isn’t new or unique to AI; banks have used quantitative models for decades in areas like credit scoring, risk assessment, and pricing, and regulators, including the OCC and Federal Reserve, have long-standing supervisory guidance specifically addressing how banks should identify, measure, and manage this kind of risk.

What has changed with the growth of AI and machine learning in banking is the scale and complexity of the models involved, which has intensified regulatory attention on how existing model risk management principles apply to these newer, often more sophisticated systems.

Why AI Models Raise Distinct Concerns

Several characteristics of modern AI models make model risk management more challenging compared to simpler, traditional statistical models. Complex machine learning models can combine large numbers of variables in non-linear, interdependent ways that make it genuinely difficult, even for the people who built the model, to fully explain why it produced a specific output for a specific case — a challenge often called the “black box” problem. This complicates a core part of model risk management: independently validating that a model is behaving as intended and producing reliable outputs across the full range of situations it will encounter in practice.

AI models can also degrade in accuracy over time in ways that aren’t always immediately obvious, particularly if the real-world data the model encounters after deployment starts to differ meaningfully from the data it was originally trained on, a phenomenon sometimes called model drift. Without careful, ongoing monitoring, this kind of gradual performance degradation could go unnoticed until it produces a material error or a pattern of poor decisions.

What Regulators Expect Banks to Do About It

Given these concerns, regulators generally expect banks to apply rigorous model risk management practices to their AI systems throughout the full model lifecycle, not just at the point of initial deployment. This includes thorough validation before a model goes into production, ongoing performance monitoring after deployment, clear documentation of how a model works and its limitations, and defined processes for retraining or retiring a model when its performance is no longer adequate. These expectations apply whether a bank built the AI model in-house or is using one purchased or licensed from a third-party vendor, since the bank itself remains ultimately responsible for understanding and managing the risks of any model it relies on for material business decisions.

Bottom Line

Model risk is the risk of adverse outcomes from relying on a flawed, misused, or poorly understood model, and regulators pay particularly close attention to it with AI because complex machine learning models can be harder to interpret, validate, and monitor than traditional models, requiring banks to apply rigorous, ongoing governance throughout an AI model’s entire lifecycle.

Go deeper

Important caveats

Model risk management requirements and expectations continue to evolve as AI adoption in banking grows, and specific regulatory guidance is subject to updates over time.

Frequently asked questions

What does "model validation" mean in banking?

Model validation is the process of independently evaluating whether a model is conceptually sound, performs as intended, and is being used appropriately for its designed purpose. It typically involves testing a model's outputs against expectations, reviewing its underlying assumptions and data, and is usually performed by a team independent from the one that built the model.

Why are complex AI models considered harder to validate than simpler models?

More complex machine learning models can combine many variables in ways that make it harder to fully understand why the model produces a specific output for a specific case, sometimes called the "black box" problem. This complexity can make it more difficult for validators to fully assess whether the model is behaving as intended across all relevant situations.

Does model risk only apply to models banks build themselves?

No. Model risk management expectations generally apply to models banks use regardless of whether they were built in-house or purchased from a third-party vendor, since the bank remains responsible for understanding and managing the risks of any model it relies on for material decisions.

Sources

[1]OCC — Office of the Comptroller of the Currency
[2]Federal Reserve — Board of Governors of the Federal Reserve System

Written by Editorial Team

Last updated July 28, 2026

Get one well-sourced answer a week

No spam. Unsubscribe anytime.