How AI is Transforming Model Risk Management in Banks
Banks have long relied on diverse models to support critical functions such as customer acquisition, collections, financial crime management—especially money laundering—and capital adequacy.
With the continual adoption of new technologies—ranging from advanced compute technologies to machine learning (ML) techniques—the pace of developing and deploying models has accelerated significantly. This rapid evolution has driven an exponential increase in the size and complexity of model inventories, making the management of model risk—the potential for adverse consequences from flawed or misused models—an essential priority for financial institutions.
The Importance of Model Risk Management
Model risk is recognized as one of the key risks banks must manage, subject to significant regulatory oversight. Regulatory guidance such as the United States’ SR 11-7 and the United Kingdom’s SS1/23 mandate robust model risk management (MRM), most notably through the three lines of defense framework. Under this structure:
- The first line comprises model development;
- The second line involves independent validation and certification of models;
- The third line ensures oversight by verifying adherence to policies and procedures across both development and validation processes.
While enhancing MRM across all three lines of defense is imperative, it is not easy. However, the advent of generative AI (GenAI) and AI agents offers an opportunity to improve MRM.
Opportunities Presented by Generative AI
These technologies can increase productivity by improving the efficacy of all the tasks and activities related to model risk management. They help reduce errors and strengthen compliance by automating routine tasks, augmenting human judgment, and enhancing transparency. Specifically, AI agents enable proactive compliance through self-monitoring systems that continuously scan for deviations, undocumented changes, and policy breaches before regulators scrutinize and identify these gaps. This underscores the urgent need for financial institutions to adopt GenAI and AI agents across the model risk function.
To realize the full potential of GenAI and AI agents in model risk management, financial institutions must embed these technologies across the three lines of defense framework.
Key Activities for Model Risk Management
Financial institutions must incorporate GenAI and AI agents across key activities within model development, validation, audit, and proactive compliance. The following table outlines the areas where AI can help in the model risk management lifecycle:
Line of Defense – Key Activities – How GenAI and AI Agents Can Help – Impact
- First Line of Defense – Model Development: Document Creation – Automate model documentation drafting – High impact
- Feature Lineage Identification – Generate lineage maps from code and metadata – Medium impact
- Second Line of Defense – Model Validation: Unauthorized Model Use – Identify unauthorized model use by leveraging AI agents – High impact
- Document Creation – Automate drafting of model validation reports – High impact
- Third Line of Defense – Audit and Oversight: Document Creation – Automate drafting of audit reports – High impact
- Change Identification (Codes and Documents) – Detect undocumented changes in code and documents – High impact
The transformational potential of GenAI and AI agents across model risk functions is unquestionable. However, their integration must be carefully managed to avoid introducing new risks.
Implementing a Risk-Based Approach
As financial institutions begin to operationalize these technologies, it becomes essential to establish robust guardrails that ensure responsible use, maintain regulatory compliance, and preserve trust in automated processes. Model-driven decision-making carries inherent risks as outcomes are essentially estimates subject to uncertainty and underlying assumptions.
To successfully adopt GenAI and AI agents across model risk functions, banks will need to navigate the following key steps:
- Start with low-risk models: Select activities with limited regulatory or financial exposure.
- Build a GenAI solution: Design a secure solution with defined scope and clear objectives.
- Perform human-in-the-loop evaluation: Ensure experts review and validate GenAI outputs.
- Rectify deficiencies or gaps: Document errors and implement remedial measures.
- Experiment with GenAI in low-risk areas: Deploy solutions for a defined period to monitor performance metrics.
- Extend to medium- and high-risk areas: Scale adoption to higher-risk areas with enhanced guardrails.
In the rapidly shifting BFSI industry, the demand for risk models is set to increase, bringing complexity and underscoring the need for speed and shorter model production cycles. Model risk teams will need to continually adapt to meet the growing demands from the model risk management function—and the way forward lies in embracing AI technologies.
The next evolution of AI—especially agentic systems capable of autonomous reasoning—will push model risk management toward more fluid, real-time oversight.
Financial institutions must modernize their MRM foundations to accommodate autonomous agents, higher model refresh velocity, and AI-generated insights, managing expanding model portfolios with consistency, speed, and confidence. The time to act is now—banks that do will gain from the first-mover advantage and march ahead of their peers.
