What is model risk management?

Model risk management is the discipline a bank uses to control the risk of loss or poor decisions caused by models that are wrong or used in the wrong way. It keeps an inventory of models, validates them independently, monitors their performance, and governs who may build, approve and change them. Banking supervisors in most markets expect it.

Why does model risk management matter once AI agents act?

Because an agent behaves like a model and is harder to pin down. Its output depends on the underlying model, its instructions, the tools it can call, the sources it reads and the limits around it. Change any of these and its behaviour changes. A model risk framework built for a credit scorecard that is retrained once a year does not automatically cover that.

Supervisors have set the expectations. In the US, SR 11-7 sets out interagency model risk guidance. In the UK, PRA SS1/23 sets model risk management principles for banks. In Canada, OSFI Guideline E-23 covers model risk management. Whether an agent counts as a model under these is the first question to settle, answered in is an AI agent a model under bank model risk rules?

How does model risk management work in practice?

• Inventory: every model, including agents, recorded with an owner and a purpose.
• Tiering: models ranked by how much harm an error could cause, which sets the level of scrutiny.
• Development standards: documentation, testing and data requirements.
• Independent validation: a team separate from the builders tests that the model is sound and fit for its use.
• Ongoing monitoring: performance tracked against thresholds.
• Change control: material changes revalidated before use.
• Governance: a named senior owner and regular reporting.

For agents, change control needs widening. A new source document, a revised instruction or a new tool connection can each be a material change. The detail by regime is in SR 11-7 model risk management for AI agents and PRA SS1/23 model risk management for AI agents.

What does that look like in an example?

A mid-sized bank deploys an agent that triages customer complaints and drafts responses. The model risk team adds it to the inventory, tiers it as medium because a person sends every response, and validates it by replaying a sample of past complaints. It sets monitoring on the share of drafts that reviewers change materially. Six weeks later the complaints team adds a new policy document to the agent's sources. That counts as a change, so the agent is revalidated on the affected complaint types before the change goes live.

How is it different from AI risk management?

AI risk management is broader. It covers every risk an AI system creates: data protection, security, fairness, conduct, legal exposure and model risk among them. Model risk management is one discipline within that, focused on whether a model's outputs are sound and used correctly. A bank needs both, and they should share evidence rather than run in parallel.

Which related terms should you know?

• Model validation: the independent testing at the centre of model risk management.
• Model drift: a change in a model's performance over time.

Where model risk fits among the other limits on agents is covered in AI agents in banking.

Where Pryme fits

Attest replays an agent against real cases from the bank's own operation and scores each answer against a floor, which gives validators evidence they can rerun. Certificates lapse after 90 days and a run that clears no depth drops the agent to depth 1 the same day, so monitoring has a consequence.