GRA · Banking Nexus
Spatial financeWhere capital meets hazard, exposure and transition
Model and AI risk
Banks rely on models to grant credit, set provisions, price products, compute capital and detect fraud, and a growing share of those models use machine learning. Model risk is the potential for loss or poor decisions when a model is wrong or misused. This page sets out how model and AI risk arises, how validation and governance contain it, and which supervisory and legal frameworks now apply to automated credit decisions.
Model and AI risk on the record.
Model and AI risk: how the risk develops.
Credit automation and validation. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Drift and regime change
Models learn from past data. When the economy, customer behaviour or products change, relationships shift and accuracy decays, often quietly until losses or complaints reveal it.
Opacity weakens challenge
Complex machine learning models can be hard to explain to credit officers, customers and supervisors. Effective challenge, a pillar of model governance, is weaker when no one can say why a model decides as it does.
Bias produces unfair outcomes
Training data reflect past lending patterns. Variables that proxy for protected characteristics can produce discriminatory outcomes, adding conduct, legal and reputational risk to credit risk.
Models interact and herd
Many banks use similar vendors, data and techniques. Common models can produce herding in credit supply or market responses, and errors compound when one model's output feeds another.
What Model and AI risk means for exposure, loss and capital.
The exposure, loss, scenario and capital views a risk officer, supervisor or ministry of finance would ask for, with the frameworks they report against. Structures follow supervisory and actuarial practice. Values are illustrative: never prices, ratings or advice.
Scenario pathways
How Model and AI risk could be stressed under the scenario families central banks and supervisors use.
| Scenario family | Transition risk | Physical risk | What a stress test asks |
|---|---|---|---|
| Orderly | Early, gradual policy | Lower | Can the book absorb a steady repricing? |
| Disorderly | Late, abrupt policy | Lower to medium | What breaks under a sudden repricing and credit migration? |
| Hot house world | Limited policy | High and rising | Where do physical losses concentrate in collateral and insurance? |
What is measured, and how well.
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Model inventory coverage | count of models by tier and validation status | quarterly | Model risk management records | REPORTED |
| Discriminatory power of credit scorecards | Gini coefficient or area under the curve | annual | Model validation | MODELLED |
| Population stability index | dimensionless | monthly | Model monitoring | OBSERVED |
| Calibration gap of default predictions | difference between predicted and observed default rates | annual | Back-testing | OBSERVED |
| Overdue validation findings | count by severity | quarterly | Model risk reports | REPORTED |
| Approval rate ratio across groups | ratio of approval rates | annual | Fair lending analysis | ESTIMATED |
| Overrides of automated decisions | share of decisions overridden | monthly | Credit decision logs | OBSERVED |
Where the evidence comes from.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| Federal Reserve and OCC supervisory guidance on model risk management (SR 11-7) | Expectations for model development, validation and governance | Public domain |
| PRA supervisory statement on model risk management principles for banks | UK principles for model identification, governance and validation | Free, Bank of England terms of use |
| ECB guide to internal models | Supervisory expectations for internal ratings-based and other internal models | Free, attribution |
| EBA follow-up report on machine learning for IRB models | Supervisory analysis of machine learning in credit risk models | Free, attribution |
| US Home Mortgage Disclosure Act data | Loan-level application and decision data used in fair lending analysis | Public domain |
| FSB and BIS reports on artificial intelligence in finance | Assessments of financial stability implications of artificial intelligence | Free, attribution |
Who decides, and what the evidence serves.
Banking Nexus prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Bank board and model risk committee | What model risk appetite to set and which uses of AI are acceptable | Model inventory, tiering and validation findings |
| Independent model validation function | Whether a model is fit for purpose and what conditions or limits apply to its use | Back-testing, benchmarking, explainability and fairness tests |
| Prudential and conduct supervisors | Whether internal models can be approved for capital and whether automated decisions treat customers fairly | Validation reports, outcome data and governance evidence |
| Data protection and market surveillance authorities | Whether credit scoring systems meet legal duties on transparency, accuracy and human oversight | Technical documentation, impact assessments and testing records |
Outputs this topic produces
- Guides to validating machine learning credit models, including explainability and fairness tests
- Comparisons of model risk management expectations across jurisdictions
- Research on herding and concentration in AI vendors and data
- Briefings on how the EU AI Act and similar rules apply to credit scoring
Shared questions the industry asks.
- 01
Do models perform as intended?
Whether models remain accurate and stable outside the conditions they were built on.
- 02
Can decisions be explained?
Whether credit decisions made with complex models can be explained to customers and supervisors.
- 03
Are outcomes fair?
Whether models produce unjustified differences across groups.
- 04
What happens when many banks use similar models?
Whether shared models and data create correlated decisions.
How the risk arises and transmits.
Model risk arises from errors in design, data or use, and from using models beyond their intended scope. It can cause losses, mispriced risk and unfair treatment.
Machine learning can capture complex patterns but may rely on spurious correlations, degrade as conditions change and resist explanation. Validation must test not only accuracy but stability, bias and behaviour in stress.
Data quality and representativeness shape outcomes. Models trained on historical decisions can reproduce past exclusion; alternative data can widen access or introduce new biases.
Herding is a systemic concern. If many lenders use similar models, vendors or data, they may tighten or loosen credit together, amplifying cycles.
Generative AI introduces new risks in customer service, coding and document analysis, including fabricated outputs and data leakage, which require controls and human oversight.
How evidence is gathered, and where it stops.
| Method or data | What it shows | Its limit |
|---|---|---|
| Independent validation | Model soundness and limits | Depends on validator independence and skill |
| Back-testing | Performance against outcomes | Past conditions may not recur |
| Fairness testing | Differences across groups | Choice of fairness metric matters |
| Monitoring for drift | Changes in performance | Detects problems after they emerge |
How it is studied, and what the methods cannot say.
- 01Artificial intelligence and machine learningCredit decisioning with explainability · Early warning and transaction monitoringApplied here
- 02Probability and statisticsEstimating default and loss parameters · Operational loss modellingApplied here
- 03Financial and risk engineeringExpected credit loss modelling · Counterparty exposure and valuation adjustmentsApplied here
- 04Financial economics and macro-financeMacro-financial stress scenarios · Credit cycle and buffer calibrationApplied here
Questions and answers.
What is model risk?
Is machine learning allowed in regulatory capital models?
How is credit scoring treated under the EU AI Act?
Does GRA validate banks' models?
Is AI in credit decisions harmful?
Why is herding a concern?
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GRASend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGlobal Risks AllianceSee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring an exposure or capital question to the Alliance.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.