Banking supervisors in most markets expect models to be inventoried, validated by independent people, monitored in use and owned by someone accountable. When banks put AI agents into credit, fraud or servicing, that discipline reaches the agents. The result is demand for model owners, validators and the operations staff whose review decisions supply monitoring evidence.
What does model risk supervision ask of people?
Model risk is the risk of loss or harm from decisions based on models that are wrong or misused. Supervisors have set out principles for managing it: SR 11-7 from the US banking agencies, the PRA's SS1/23 for UK banks, and OSFI's Guideline E-23 in Canada. The Basel Committee and ECB banking supervision treat model risk as part of sound risk management across Europe and beyond.
The details differ, but the shared expectations for people are clear:
- Ownership. Each model has a named owner accountable for its use and performance.
- Effective challenge. Models are reviewed by people with the competence, independence and authority to question them.
- Validation. Models are tested before use and periodically after, including on their outcomes.
- Ongoing monitoring. Performance is tracked in use, and problems trigger action.
- Governance. There is an inventory, a policy and clear roles, from the board down.
A plain introduction to the discipline is in what is model risk management.
Who is covered, and are agents "models"?
Model risk expectations apply to banks and other supervised lenders. They cover any quantitative method that turns inputs into estimates used for decisions, and supervisors have made clear in substance that AI and machine learning methods sit within scope.
An AI agent is not one model. It combines a model provider's language model with instructions, sources, tools and limits. But its outputs feed decisions, such as a credit recommendation, a fraud disposition or a hardship arrangement, and banks increasingly place agents within model risk governance or a closely related framework. Expect to hear the agent described as "a model" in some banks and "a tool using a model" in others. The controls asked of the people around it are similar either way.
Which roles and competence does this create?
Model risk has always had specialist roles. Agents add operational ones that feed them.
| Role | What it does around agents | Typical background |
|---|---|---|
| Model or agent owner | Answers for one agent's purpose, scope, performance and remediation | Experienced team lead or product manager |
| Model validator | Tests the agent independently before and after deployment | Quantitative, audit or risk background |
| Model risk analyst | Maintains the inventory, tracks findings and reports to governance | Risk, compliance or audit |
| Reviewer or operator | Reviews agent-held decisions; overrides become monitoring evidence | Credit, fraud, servicing or collections |
| First-line quality analyst | Samples decisions and reports trends to the owner | Quality assurance or operations |
The reviewer's role is often overlooked. Every override, with its reason, tells the owner and validator where the agent is weak. A reviewer who records decisions well is producing outcomes data the model risk function depends on. That is a strong argument to make in an interview.
Adverts may use "model user", "first line of defence" or simply "operations analyst". Read the duties for review, monitoring, findings, remediation and challenge. For retail banking routes specifically, see how to get into AI operations in retail banking.
How do you show employers you fit?
| Requirement | What employers will expect of you | How to show it |
|---|---|---|
| Ownership and accountability | Act within a named owner's framework and escalate to them | Examples of issues you raised to an accountable person |
| Effective challenge | Question the agent's output with evidence and authority | Review decisions to a standard, including reasoned overrides |
| Validation | Support or understand pre-deployment and periodic testing | Participation in testing, or a clear explanation of how it works |
| Ongoing monitoring | Record decisions so trends can be measured | Decision notes structured for analysis |
| Governance and inventory | Know where the agent sits in the bank's framework | An account of the governance you worked within |
| Competence | Show the skills the role needs, in a form the bank can file | A credential checkable at source and training records |
What might a bank interviewer ask?
- "How would you know the agent's recommendations were drifting?" Watch your own override rate and reasons, sample outcomes, and report trends to the owner rather than quietly correcting cases.
- "What does effective challenge mean to you?" Questioning outputs with evidence, having the authority to act on the challenge, and recording it.
- "Who owns the agent, and what is your responsibility if it makes a bad recommendation you approve?" The owner answers for the agent; you answer for your decision. Both are recorded.
- "Would you trust the agent more after it passes validation?" Validation sets a baseline. It does not replace review of each held case.
A collections officer we will call Marcus prepared by describing how his team's override notes had once revealed a broken data feed. Interviewers in model risk recognised it as outcomes monitoring, even though he had never used the term.
What does model risk supervision not cover?
It does not regulate how agents treat customers in conduct terms; consumer protection rules and regulators such as the CFPB, the FCA or national authorities do. It does not certify individuals. It does not tell banks exactly which AI uses count as models, so practice varies. And it does not apply to non-bank firms in the same way, although some adopt similar disciplines voluntarily.
Country routes differ. Compare AI operations jobs in retail banking in the US, in the Netherlands, and the Canadian picture in OSFI Guideline E-23 and model owner careers in Canada.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where the Academy fits
Pryme Intelligence Academy's tracks map loosely onto these roles. Operator suits reviewers whose decisions feed monitoring. Builder suits people who design and certify agents, with a capstone agent certified in Attest to depth 2 or higher. Architect suits those leading regulated, multi-agent deployments, with a board review by two assessors.
Questions people ask
Do I need a quantitative degree for model risk roles?
For validator roles, often yes. For owner, analyst and reviewer roles, domain knowledge and disciplined record-keeping matter more.
Is model risk work only in large banks?
Large banks have the biggest teams, but smaller lenders and building societies also need people to own and monitor models, often combined with other duties.
Where can I see the wider picture?
The guide to AI agent jobs and careers maps how these roles connect.