AI begins transforming governance inside model risk management

Artificial intelligence is rapidly becoming a practical tool within model risk management, as financial institutions look to strengthen governance while reducing the operational burden associated with documentation, monitoring, and oversight.

Suresh Sankaran, Prudential Regulation Lead at NatWest, believes the shift toward AI enabled governance reflects growing regulatory expectations around transparency, traceability, and operational control.

Institutions are no longer experimenting with theoretical capabilities. Instead, they are focusing on targeted applications that improve how models are documented, monitored, and governed.

“The most immediate value is in inventory hygiene and evidence linking,” Sankaran said. “Using AI to classify model artefacts, extract consistent metadata, and connect models to requirements and risk themes creates a living map of what matters, where, and why.”

For many banks, maintaining accurate model inventories has long been one of the most labor intensive aspects of model risk management.

Documentation must be continuously updated to reflect model purpose, ownership, limitations, and regulatory relevance.

“In practice, inventory work fails in two predictable ways,” Sankaran said. “It becomes out of date, or it becomes performative.”

AI can address both problems by automating large portions of document analysis. Tools powered by natural language processing can review model documentation, extract key information, and identify missing or inconsistent details across portfolios.

“AI helps by doing the dull but essential reading at scale,” Sankaran said. “It pulls key fields from documentation, flags gaps, and creates a consistent structure so owners and second line teams can spend time on judgement rather than transcription.”

Beyond improving documentation, Sankaran sees growing potential for AI to enhance portfolio level oversight.

Machine learning systems can cluster models according to shared drivers, data dependencies, regulatory obligations, or known limitations.

That approach allows risk managers to identify concentrations and systemic exposures across large model portfolios.

“The objective is not to pretend AI can replace governance,” Sankaran said. “It is to let governance see the full landscape without needing to read several tonnes of PDFs first.”

However, Sankaran emphasized that automation must be introduced carefully to maintain regulatory confidence. AI systems should operate within strict control frameworks where human oversight remains central.

“Responsible automation means reducing manual effort without compromising regulatory confidence,” he said. “These tools should operate within a human in the loop framework with full traceability and strong change control.”