Artificial intelligence has swiftly moved from theoretical conversations to practical deployment across financial institutions, and with that shift comes a pressing challenge: how do we govern AI effectively, particularly within the frameworks originally designed for traditional models?
As I sat alongside my peers at CeFPro’s Advanced Model Risk USA conference panel on AI risk management, it became clear that while we all operate under different institutional contexts, we face a shared dilemma - how to bridge theory and practice in AI governance.
At Flagstar Bank, we operate under the oversight of the OCC and anchor much of our model risk management in the principles of SR 11-7.
This guidance has been a cornerstone for managing traditional models and even many machine learning applications. Its focus on sound governance, validation, and outcomes analysis remains highly relevant.
Yet, as AI technologies - particularly Generative AI - become embedded in financial services, we’re finding that SR 11-7, while robust, does not provide all the answers.
The conversation on the panel reaffirmed a truth I encounter daily: AI risk management is no longer just about models in the conventional sense.
As Chris Smigielski from Arvest Bank pointed out in the discussion that day, many AI-driven tools fall outside traditional model definitions but still require governance.
Fraud detection systems, AML monitoring, and now GenAI-powered applications are pushing the boundaries of what we once categorized neatly.
His institution’s approach of establishing an AI Center of Excellence resonated with me because it acknowledges that AI risks extend beyond the remit of model risk teams alone.
Another panel member highlighted a different critical evolution - the growing need for interdisciplinary oversight.
GenAI doesn’t just present a model risk problem; it introduces legal, privacy, compliance, and ethical considerations that traditional model validation frameworks were never designed to address comprehensively.
It’s no longer sufficient to view AI governance through a purely technical lens. Instead, we must consider who within the organization is best positioned to oversee a particular AI use case, based on the nature of the risk it introduces.
From my perspective, much of AI governance today hinges on understanding materiality and use case specificity.
Not every AI implementation demands the same rigor. For conventional machine learning models, SR 11-7 still provides a solid framework, particularly through concepts like outcomes analysis, where deterministic inputs and outputs allow for structured validation.
However, GenAI presents a different challenge. Its outputs vary with each query, making traditional validation approaches difficult to apply.
As I mentioned during the discussion, as long as human oversight remains embedded in these processes - where GenAI outputs merely assist decision-making rather than automate it entirely - the associated risks remain manageable.
