As banks accelerate AI adoption, model risk teams are struggling to keep pace with approval demands. Michael Talbert argues the real issue is not speed but flawed governance design. Structural failures, misclassification, and late involvement are creating
As artificial intelligence becomes
embedded across financial services, model risk teams are facing intensifying
pressure to approve systems at pace while maintaining rigorous governance
standards.
Yet, according to Michael Talbert,
Head of Professional Services at leading unified compliance control platform Behavox,
the industry is focusing on the wrong problem.
“The instinct is to ask how do we
approve AI faster,” Talbert says. “But the right question is which AI actually
requires deep scrutiny, and which doesn’t.”
This distinction is becoming critical
as institutions struggle with mounting approval backlogs. Many banks continue
to apply broadly uniform governance frameworks to all AI use cases, regardless
of their risk profile.
The result is a system that creates
friction at both ends. Low-risk tools become trapped in validation processes
designed for more complex systems, while genuinely high-risk applications do
not always receive the depth of scrutiny they require.
Talbert argues that leading
institutions are beginning to address this by rethinking classification before
governance even begins.
“They classify AI use cases by
approval burden before the governance process begins,” he explains. “That
changes everything.”
By doing so, model risk teams can
focus their efforts on systems that genuinely matter, particularly those
operating in regulated control functions where errors carry regulatory,
financial, or reputational consequences.
Contrary to common assumptions, most
AI approval failures are not driven by model complexity or technical
limitations.
“The conventional diagnosis focuses
on model quality,” Talbert says. “That’s real - but it’s not where most
failures actually originate.”
Instead, Talbert points to structural
weaknesses as the primary cause. The most common failure is late involvement
from model risk teams. In many cases, technology or compliance teams build or
procure AI systems independently, with model risk brought in only at the final
stage.
“By that point, documentation is
incomplete, architecture decisions are locked, and explainability has been
treated as an afterthought,” he says. “Approving it becomes extremely
difficult. Rejecting it creates significant business friction. Nobody wins.”
Another recurring issue is use case
misclassification. Teams may believe they are developing decision-support
tools, but in practice, the outputs are driving regulatory decisions.
When properly assessed, these systems
fall into much higher-risk categories than initially assumed. The gap between
perceived and actual risk can be significant, exposing institutions to
governance failures.
