AI and automation
Statistical and machine-learning models now inform credit decisions, underwriting, fraud detection, trading and operations. This page sets out how The Global Risks Alliance (GRA) researches the professional controls those models need: validation, uncertainty, explainability, human oversight and the management of third-party models. It also examines a systemic question, what happens when many institutions rely on similar models and data at once. GRA does not build, sell, audit or approve models. This page is part of financial technology and transformation.
- 01InstitutionThe Global Risks Alliance (GRA)
- 02Service levelR0: information and enquiries
- 03In briefThe short answer
- 04Where models are usedAutomation across the financial value chain
- 05RulesAI in finance: what applies, and when
- 06Earth observationMachine learning on satellite data, for exposure
- 07Professional controlsWhat sound model governance asks
GRA · Institution · service level R0
The short answer.
AI and automation in finance, at GRA, is research on the professional controls that statistical and machine-learning models in credit, underwriting, fraud detection, trading and operations need: validation, uncertainty, explainability, human oversight and third-party model management. It also asks what happens when many institutions rely on similar models; GRA certifies no model.
Draft to published version.
Fig.How a finding is reviewed before it is published. Design, not a record.
From a satellite tile to an exposure update.
How satellite radar turns a flood into an exposure update. Synthetic scene; no real event or place.
Automation across the financial value chain.
Lending decisions
Scoring, limit setting and early-warning models, where errors affect access to credit and fairness as well as losses.
Underwriting and claims
Risk selection, pricing inputs and claims triage, where model drift after a changing climate or market can mislead.
Fraud and operations
Transaction monitoring, document processing and customer service, where automation scales both efficiency and failure.
AI in finance: what applies, and when.
| Instrument | Status, October 2026 |
|---|---|
| EU AI Act high-risk duties for creditworthiness and life and health insurance pricing | Apply from 2 December 2027 under the AI Omnibus (Regulation 2026/1744) |
| US revised model risk management guidance (SR 26-2) | Issued April 2026; generative and agentic AI outside its scope |
| PRA SS1/23 | In force for UK banks with model approval |
| NIST AI Risk Management Framework | Voluntary |
Machine learning on satellite data, for exposure.
One growing use of AI in risk finance is extracting exposure and damage from imagery: building footprints, flood extent from Sentinel-1 radar, crop condition. These models change exposure layers quickly after an event and carry their own error rates, which must travel with the layer. Methods at GCRI disaster monitoring.
What sound model governance asks.
- 01
Validation
Independent testing of a model's design, data and performance against its intended use, before and during deployment.
- 02
Uncertainty
Quantifying how wrong a model could be and under which conditions, using methods such as those in uncertainty quantification and model validation.
- 03
Explainability
Being able to state why a model produced an output, to the people it affects and to those who oversee it.
- 04
Human oversight
Clear points where a competent person can review, override or stop an automated decision.
- 05
Third parties
Knowing what is inside a vendor model, how it changes and what happens if the vendor fails.
When everyone uses the same model.
Model risk is usually managed institution by institution. GRA's research interest is the shared case: common vendors, common training data and common methods can make errors correlated, so many institutions misjudge the same risk at the same moment.
- Which models and data sources are widely shared across a sector?
- How would a common error show up in credit, claims or market behaviour?
- What signals would reveal correlated model failure early?
- Which questions belong to supervisors, auditors or each institution's own validation function?
Research, not assurance.
GRA does not validate, audit, rate or certify any model or vendor, and its research is not a compliance opinion. Each institution remains accountable for its own models. The risk channel is described on AI and model risk, and a proposed AI and Financial Model Risk community is in development. Related lines: digital assets research and quantum and cryptographic transition. Governance of AI in public decisions is discussed by The Global Risks Forum (GRF) on digital and AI governance.
Terms used on this page.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Model risk management | The governance, development standards, validation and inventory controls that limit model risk, as US guidance SR 11-7 sets out. |
| Explainability | The degree to which the reasons for a model's output can be understood and stated to the people it affects. |
| Herding | Investors making similar decisions at the same time, amplifying price moves. |
| Model validation | Independent testing that a model performs as intended and is fit for a stated use. |
Where this page's references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
- EU AI Act (Regulation 2024/1689) as amended by the AI Omnibus, Regulation 2026/1744 (credit-scoring high-risk duties from 2 December 2027)
- US interagency revised guidance on model risk management, SR 26-2 (April 2026), superseding SR 11-7
- PRA SS1/23 Model risk management principles for banks
- NIST AI Risk Management Framework 1.0
- Copernicus Sentinel-1 SAR data (free, full and open)
- Copernicus Emergency Management Service rapid mapping
Questions and answers.
Does GRA use AI in its own research?
Can GRA review my institution's model?
Is this related to the GRA platform Fintech Nexus?
How can practitioners contribute?
Around GRA.
Start with an enquiry.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.