Our technological landscape is evolving so rapidly that conversations about artificial intelligence (AI) risk management often struggle to keep up. We get stuck in definitions - what is a model, what is AI, and where do we draw the line?
As a panellist at CeFPro’s Advanced Model Risk 2025 conference this year, discussing risk practices with colleagues from institutions like Morgan Stanley and Flagstar Bank, I found myself returning to a more pragmatic stance.
The reality is, regardless of labels or regulatory clarity, AI is here, it's expanding fast, and financial institutions must decide how to govern it effectively – and they need to decide now.
At Arvest Bank, like many others, we began our AI risk journey anchored in SR 11-7. It’s a solid, principles-based framework, and when we first wrote our model risk management policy, SR 11-7 was our north star.
But AI, especially machine learning and now Generative AI (GenAI), has pushed us beyond the comfortable boundaries of traditional model risk management.
We quickly realized that if we limited ourselves to the strict definition of a "model," we’d leave significant risks unmanaged - not because they didn’t exist, but because they didn’t fit neatly into outdated categories.
Our model inventory evolved organically. It wasn’t just predictive models anymore; we started including tools like fraud monitoring systems and AML frameworks.
These aren’t conventional models - they’re often rules-based - but they are critical to the bank’s operations and, therefore, require oversight.
The same logic applies to AI. Not every AI implementation should be forced into a model risk framework but ignoring them is not an option either.
This is why we created an AI Center of Excellence at Arvest. If something contains AI but doesn’t meet our definition of a model, it still lands within this governance structure.
It’s a flexible, risk-based framework informed by SR 11-7 but adapted for the nuances of AI. It ensures that AI tools are identified, inventoried, assessed for risk, and monitored over their lifecycle - even if they aren’t formally validated like traditional models.
I’d rather have a conversation with regulators about which framework is appropriate than explain why we ignored something entirely.
One of the biggest challenges I highlighted during the panel is performance monitoring.
With traditional models, you know the drill - annual reviews, recalculations, outcome analysis. But how do you apply that discipline to AI tools, especially GenAI applications where outputs can vary day-to-day?
The answer isn’t straightforward, and it’s clear we can’t tackle this manually, since AI scales across institutions.
I’ve been actively engaging vendors to explore automated solutions, because if we have a manageable number of AI instances today, that number will likely multiply exponentially in the coming years. Without automation, we risk being overwhelmed.
Another critical point from our discussion was the shift from focusing solely on algorithms to focusing on use cases.
