1. How can banks tailor model risk management to model risk?
Rather than applying uniform requirements across all models, banks should focus model risk management activities where risk is greatest. The revised guidance gives institutions greater flexibility to tailor oversight according to the risk posed by a model. Many banks have already introduced new lowest/de minimis risk tiers to better differentiate validation requirements. Others are evaluating the scope of certain model types and whether certain low-risk calculations, tools or use cases require similar levels of documentation, model validation and monitoring as business-critical models.
The goal of a more tailored approach is to focus governance, validation and monitoring efforts where model risk is greatest while reducing unnecessary requirements for lower-risk models.
2. Can continuous monitoring more effectively manage model risk?
Financial institutions today are placing greater emphasis on continuous monitoring as model risk can emerge between scheduled reviews and revalidations. Ongoing oversight provides more timely insights into model performance and supports faster risk management decisions. The COVID-19 pandemic, rapid interest rate movements and periods of market stress demonstrated the limitations of relying solely on periodic reviews to detect emerging model issues. The shift from periodic validation and review activities to continuous monitoring reflects the reality that model performance can deteriorate quickly when underlying conditions change and gives firms the ability to assess model performance more frequently using key risk indicators.
Many institutions are investing in dynamic monitoring capabilities, with automated metrics, performance thresholds, escalation triggers and real-time reporting integrated into model risk management capabilities. Continuous monitoring provides earlier and more actionable insights, resulting in a more efficient approach and allowing for less reliance on periodic reviews.
3. How is model validation evolving under the revised guidance?
Model validation is becoming more flexible, more technology enabled and more closely connected to ongoing monitoring activities. The revised guidance creates opportunities to better integrate validation, revalidation, annual reviews and monitoring activities, helping to reduce duplication while maintaining the importance of independent model validation. It also provides greater flexibility in how validation activities are structured and executed.
Model validation is also evolving as many banks are exploring how technology can enhance validation capabilities. Investments in centralized testing platforms, inventory and workflow tools, automated testing libraries, and improved access to development infrastructure may help validation teams improve both efficiency and effectiveness.
4. What does AI model governance require from banks?
Effective AI model governance requires institutions to balance innovation with appropriate risk management and oversight. The adoption of generative AI (GenAI) and agentic AI is expanding model inventories across the industry. While the revised guidance notes that GenAI and agentic AI are outside the formal scope of the guidance, organizations are still expected to apply sound risk management, governance and controls commensurate with the risk posed by such techniques and associated use. Increasingly, banks are relying on the first line of defense to play a more active role in governance, which reflects the proliferation of use cases across firms. Nevertheless, model risk management is expected to continue to play a key role in mitigating the risk of GenAI and agentic AI models, including use case identification, model determination, risk tiering, model validation and usage.
