AI and model risk
Financial institutions increasingly rely on models they did not build and cannot fully see: credit scoring, fraud detection, catastrophe models, trading systems and, now, general-purpose AI supplied by a small number of providers. The Global Risks Alliance (GRA) examines how model failure becomes financial loss: through validation gaps, third-party concentration and weak human oversight. It works on shared, precompetitive questions of method, never on any firm's own models. See Financial-system risk.
- 01InstitutionThe Global Risks Alliance (GRA)
- 02Service levelR0: information and enquiries
- 03In briefThe short answer
- 04TransmissionHow model failure becomes financial loss
- 05Supervisory frameModel risk rules changed in 2026
- 06Systemic angleWhen many institutions use the same model
- 07QuestionsShared questions GRA works on
GRA · Institution · service level R0
The short answer.
AI and model risk in finance is the potential for loss from models that institutions rely on but did not build and cannot fully see, such as credit scoring, fraud detection, catastrophe models, trading systems and general-purpose AI from few providers. GRA examines how validation gaps, third-party concentration and weak oversight turn model failure into loss.
From a satellite tile to an exposure update.
How satellite radar turns a flood into an exposure update. Synthetic scene; no real event or place.
How model failure becomes financial loss.
| Channel | How the shock reaches finance |
|---|---|
| Validation gaps | A model performs outside the conditions it was tested on, and losses or mispricing follow before anyone notices |
| Third-party concentration | Many institutions rely on the same model or AI provider, so one fault or outage is correlated across firms |
| Herding | Similar models trained on similar data respond the same way to the same signal |
| Oversight failure | Automated outputs are acted on without a person able to understand, challenge or stop them |
| Data drift | Climate, demographic or market shifts make historical training data a poor guide |
Channels describe mechanisms, not measured strengths or probabilities.
Model risk rules changed in 2026.
| Instrument | Status, October 2026 | What it covers |
|---|---|---|
| US revised interagency guidance on model risk management (SR 26-2) | Issued April 2026 by the Federal Reserve, OCC and FDIC; supersedes SR 11-7 | Principles-based, risk-tailored model risk management; generative and agentic AI are stated to be outside its scope |
| PRA SS1/23 Model risk management principles | In force for UK banks with internal model approval since May 2024 | Model identification, governance, development, validation and risk mitigants |
| EU AI Act, as amended by the AI Omnibus | Credit-scoring high-risk obligations now apply from 2 December 2027 | Risk management, data governance, human oversight and documentation for high-risk AI, including creditworthiness assessment |
| NIST AI Risk Management Framework | Voluntary, 2023 | Govern, map, measure and manage functions for AI risk |
When many institutions use the same model.
Model risk becomes a stability question when the same vendor model, data set or foundation model sits behind many decisions. Catastrophe models used across reinsurers, credit scores used across lenders and market-data feeds used across trading desks can all move in the same direction at once. GRA studies that common-mode exposure at sector level: which model families are shared, what happens when their inputs shift, and what independent challenge exists.
Method guidance continues at AI and Financial Model Risk; AI oversight governance at GRF AI oversight and accountability.
Shared questions GRA works on.
- 01
Validation under compound shocks
How should models be tested against conditions outside their history, such as compound physical and operational events?
- 02
Provider dependency
How concentrated is the industry's reliance on a small number of model and AI providers, and what fails together?
- 03
Human oversight
What does meaningful human review look like when a decision relies on a model no one in the room built?
- 04
Catastrophe model uncertainty
How should differences between hazard models be shown to financial readers, rather than averaged away?
Methods for the industry, not reviews of a firm.
- GRA does not validate, approve or certify any institution's model, and issues no model rating.
- Its outputs are shared methods and evidence, published where review and rights allow.
- No member's confidential model information is exchanged with another.
- Supervisory expectations remain with supervisors; GRA's cyber and operational work covers the related third-party questions.
The same subject across the Consortium.
AI and Financial Model Risk
The specialist community, in development: AI and Financial Model Risk.
AI science
Evidence on AI and autonomous systems from The Global Centre for Risk and Innovation (GCRI): AI and Autonomous Systems.
AI governance
Governance dialogue convened by The Global Risks Forum (GRF): AI and Digital Governance.
Terms used on this page.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Model risk | The potential for adverse consequences from decisions based on incorrect or misused model outputs, as SR 11-7 describes it. |
| Model validation | Independent testing that a model performs as intended and is fit for a stated use. |
| Concentration risk | The risk from dependence on a single provider or a small number of providers. |
| Human oversight | Review of automated decisions by people with the authority and information to change them. |
Where this page's references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
- US interagency revised guidance on model risk management, SR 26-2 (April 2026), superseding SR 11-7
- SR 11-7 Supervisory Guidance on Model Risk Management (2011; superseded April 2026)
- PRA SS1/23 Model risk management principles for banks
- EU AI Act (Regulation 2024/1689) as amended by the AI Omnibus, Regulation 2026/1744 (credit-scoring high-risk duties from 2 December 2027)
- NIST AI Risk Management Framework 1.0
Questions and answers.
Will GRA review our institution's models?
Does GRA set standards for AI in finance?
How can a model risk specialist contribute?
Around GRA.
Start with an enquiry.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.