Financial institutions are struggling to fit rapidly evolving AI into traditional model risk frameworks. Risk leaders warn that interconnected agents, dynamic data, third-party models and continuous change require a shift toward system-level governance, automated monitoring and proportionate oversight without sacrificing human judgment.
Financial institutions need to
rethink model risk management around AI as an interconnected system rather than
simply forcing increasingly sophisticated technology into frameworks designed
to govern individual models.
As agents proliferate and share
common data, tools and methodologies, risks that appear separate could prove
dangerously dependent on one another.
Speaking at CeFPro’s 2026 Risk
Americas event, an SVP and Head of Line of Business Model Risk Management at a
major U.S. bank warned that institutions may be underestimating those
dependencies.
Multiple AI agents deriving decisions
from similar concepts, tools and data cannot necessarily be treated as
unrelated exposures.
“We have N agents, and we have N
times X amount of risk we’re carrying. I don’t think that’s quite right,” the
senior model risk executive said.
The comparison carries uncomfortable
historical echoes. Drawing on his experience during the global financial
crisis, he recalled how assumptions around correlation ultimately proved
problematic.
AI could create another environment
in which individually manageable exposures become considerably more dangerous
when their underlying dependencies emerge.
A Head of Machine Learning and Model
Governance at a financial services company argued that generative AI also
requires dynamic data governance.
Institutions may not fully understand
the internal workings of black-box systems, making strong controls around
inputs and monitoring of outputs increasingly important.
A Director of Controls at a financial
risk advisory firm similarly warned against excessive dependence on individual
large language models, particularly for customer-facing applications.
Benchmarking alternatives and
avoiding concentration around one model should form part of effective model
risk management.
More fundamentally, she argued, “AI
is a systems problem, not just a model problem.”
Traditional MRM typically examines
individual models deeply, while AI demands greater attention to use cases,
interdependencies and the different models operating within an interconnected
environment.
That creates a fundamental problem of
speed. AI tools can emerge and improve within weeks while established
validation processes may take months.
The bank’s senior model risk
executive said institutions are still learning how to reconcile that mismatch
while ensuring new technology satisfies established compliance obligations.
“We’re learning,” he said. “We’re not
there yet.”
The challenge is to prevent
governance becoming either an obstacle to useful innovation or incapable of
controlling it.
Panelists repeatedly returned to risk
and reward, arguing that institutions should determine whether AI generates
sufficient value to justify the additional uncertainty it introduces.
