As artificial intelligence reshapes financial decision making, traditional model risk frameworks are being stretched to breaking point. At a recent flagship US conference, senior risk leaders debated how banks should govern AI tools whose scale, opacity,
Senior risk managers have been warned
that artificial intelligence is forcing banks to rethink how model risk,
governance, and accountability are defined.
At a CeFPro conference on vendor
risk, one session explained how, as machine learning moves from experimentation
to embedded decision making, long-standing validation frameworks are being
stretched, exposing gaps in oversight, explainability, and control that
institutions can no longer afford to ignore.
The discussion, led by senior heads
of modeling and model risk at large US and international banks, made clear that
many firms are trying to stretch frameworks designed for statistical credit and
market models to fit tools built on machine learning, large language models,
and vendor provided analytics.
The result, participants suggested,
is growing friction between innovation and control.
A senior modeling leader at a mid
sized US consumer finance institution described how her organization manages
more than one hundred models across regulatory, pricing, and marketing use
cases.
From her perspective, the first line
can no longer treat AI governance as something handed off downstream.
Controls, documentation, and risk
mitigation must be embedded at design stage, even when regulations remain
fragmented across states and use cases.
The emphasis, she argued, is less
about regulatory minimums and more about doing the right thing for customers
and employees.
Much of the tension centers on
definitions. Several speakers noted that internal debates over what constitutes
a model versus a tool have returned with greater force in the AI era.
Not every statistical technique is
artificial intelligence, and not every AI enabled application should
automatically trigger the highest risk rating.
Without a shared language, firms
struggle to conduct meaningful gap and risk assessments, particularly when
tools are sourced from vendors and embedded across multiple workflows.
A head of model risk management at
the US branch of a large international bank traced this problem back to
regulatory history.
Model definitions established more
than a decade ago still underpin supervisory expectations, yet the population
of analytical tools has expanded dramatically.
End user computing tools, vendor
hosted AI services, and generative applications now sit uneasily alongside
traditional valuation and credit models. According to the speaker, the boundary
between model and non model is no longer a helpful organizing principle.
Data emerged as the most consistent
point of concern. Participants repeatedly emphasized that no AI control
framework can compensate for weak data governance.
