Blog Post

Model Risk Management for AI in Lending

John Christiansen | 13.10.2026
Share LinkedIn

Key Takeaways

  1. US supervisors replaced SR 11-7 with SR 26-2 in April 2026, but the core disciplines of inventory, validation and monitoring carry straight over.
  2. US guidance, the PRA's SS1/23, the EBA's loan origination guidelines and the EU AI Act use different words for the same four expectations.
  3. AI models are harder to govern because their behaviour is learnt from data, drifts over time and often depends on components the bank did not build.
  4. Buying a credit model or decision tool from a supplier moves the work, but never the accountability, away from the lender.

What Model Risk Management Means in Lending

A model is any method that turns data into an estimate someone relies on. In lending that includes the probability-of-default scorecard, the affordability calculation, the pricing grid, fraud scores and other elements such as the components of capital calculation and the expected credit loss (ECL) model. Model risk is the chance of losing money, treating customers unfairly or misreporting because one of those estimates was wrong or was used for something it was never designed to do.

Managing that risk comes down to five plain questions:

  1. Do we know every model we rely on?
  2. Who owns each one?
  3. Was it tested by someone independent before we used it?
  4. Are we watching whether it still works?
  5. If it fails, how much damage can it do before we notice?

A model risk management framework is the written answer to those questions: the policy, the inventory, the roles, the validation standards and the reporting that together let a board say it understands the models driving its lending. It is not only about complex AI. The PRA explicitly extends its expectations to material deterministic calculations that inform key decisions, not just statistical models. What AI changes is the difficulty of answering the five questions honestly, which is why regulators have spent the last three years sharpening them.

The Four Rulebooks That Apply to a Credit Model

Any lender operating across the US, UK and EU can face four overlapping sets of expectations. Figure 1 shows how they arrived.

Figure 1: The rulebooks that shape model governance in lending

1. US Supervisory Guidance: SR 26-2

For fifteen years SR 11-7, issued in April 2011, was the global reference point for model risk. On 17 April 2026 the Federal Reserve, OCC and FDIC replaced it with SR 26-2, which also supersedes the 2021 interagency statement on BSA/AML models. The new guidance keeps the core disciplines of governance, independent validation and ongoing monitoring, but puts far more weight on tailoring effort to each institution's model risk profile. Several commentators note that generative AI sits outside its scope, which leaves banks needing separate governance for those tools. For anyone still citing the 2011 letter in policies or supplier contracts, now is the time to update the reference.

2. UK: PRA SS1/23

The PRA's supervisory statement on model risk was published in May 2023 and took effect on 17 May 2024. It sets five principles: model identification and risk classification, governance, development and use, independent validation, and risk mitigants. Formally it applies to banks with internal model approval for regulatory capital, but many other firms use it as the benchmark. It expects a named Senior Manager to own the framework and addresses the risks of AI and machine learning as part of model risk generally, rather than as a separate regime.

3. EU: EBA Guidelines on Loan Origination and Monitoring

The EBA guidelines, applicable from 30 June 2021, govern how EU banks and consumer creditors assess creditworthiness throughout the life of a loan. They contain specific requirements on the use of automated models in creditworthiness assessment and credit decisions, including governance for how such models are designed and used. UK consumer lenders face a parallel expectation under the FCA's CONC 5.2A, which requires a reasonable creditworthiness assessment that considers affordability risk, not just credit risk.

4. EU: the AI Act

The AI Act classes AI systems used to evaluate the creditworthiness of individuals, or to establish their credit score, as high-risk. Those obligations were due in August 2026, but the Digital Omnibus, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and moved them to 2 December 2027. The substance is unchanged: providers and deployers will need risk management, data governance, technical documentation, automatic logging, human oversight and evidence of accuracy and robustness. The extra sixteen months are runway, not relief.

What All Four Rulebooks Ask For

Reading side by side, the four rulebooks converge on the same four expectations: table one maps these.

The practical lesson is that a lender does not need four frameworks. It needs one framework built on these four expectations, with a mapping layer that shows each regulator where its specific requirements are met.

Why AI Is Harder to Govern

  1. Behaviour is learnt, not written. A scorecard's logic can be read line by line; a gradient-boosted model's cannot, so validation relies more on testing outcomes than reading code.
  2. Explanations are approximations. Methods such as SHAP estimate why a model produced a score; they are useful for reason codes but can mislead if treated as the model's actual logic.
  3. Drift arrives faster. Models using transaction or open banking data react quickly to changes in spending patterns, so monitoring intervals built for bureau scorecards are too slow.
  4. Proxies appear unasked. Rich data can reconstruct protected characteristics indirectly, which makes fairness testing part of validation rather than an optional extra.
  5. Much of it is bought in. A third of AI use cases in UK financial services are third-party implementations, and 46% of firms admit only partial understanding of the AI they use.
  6. Change NEVER stops. Retraining is a model change, and a model that retrains monthly needs a change process that runs monthly too.

Who Checks a Tool You Bought From a Supplier?

You do. Supervisors are clear that outsourcing a model does not outsource accountability for it, and SS1/23 notes that suppliers may find its expectations useful precisely because their clients will be held to them. If you buy AI credit decisioning as a service, ask the supplier for:

  1. Model documentation covering purpose, training data, method, known limitations and intended population.
  2. The latest independent validation report and the right to commission your own validation, with access to test data.
  3. Monitoring reports with agreed thresholds for discrimination, calibration, stability and drift.
  4. A version history, advance notice of changes and a client approval step before anything reaches production.
  5. Decision-level explanations and reason codes you can give to a declined applicant.
  6. The ability to replay any past decision with the exact model and rule versions that produced it.
  7. Fairness testing results and a description of how proxies for protected characteristics are controlled.
  8. Audit rights, data ownership terms and a tested route to export your data and decision history.

ezbob runs model change the way a bank's model committee would. Each change moves through documented stages covering reason, analysis, planning, build, testing, client presentation, finalisation and deployment with simulated impacts, and nothing reaches production without written approval from the client's Head of Risk or Chief Risk Officer.

Every model carries an identifier that encodes the client, version, stage (development, test or production) and credit product, so the record shows exactly which version made which decision. Our models are built on explainable AI principles aligned with the AI Act's requirements, a theme we develop in explainable AI in credit risk.

What This Means for Your Lending Platform

Most of what the rulebooks ask for is the platform's job, not the model's.

A model produces a number. The platform decides which data the model saw, which policy rules ran before and after it, which version was live, whether a human overrode the result and what the customer was told. If the platform cannot show which rules applied and why, no amount of paperwork will fix it, because the evidence was never captured in the first place.

That is why ezbob treats AI model governance as a property of the platform rather than a document. Policy rules, cut-offs and pricing sit in the Configuration Studio, where changes are controlled by role-based permissions with segregation of duties. Every decision event, state change and user action is written to an immutable, tamper-evident audit trail, each client's data sits in its own dedicated databases, and clients hold contractual rights to audit the platform and its controls. For the regulatory context, see our articles on AI automated credit decisioning, what the FCA's Mills Review means for lending, RegTech in lending and regulatory compliance in digital banking.

FAQ

What is the difference between model risk management and AI governance?

One covers any quantitative method whose output drives a decision, whether AI or not. The other is broader: it also spans ethics, data protection, staff use of generative tools and AI that is not a model in the supervisory sense, such as a customer chatbot. In credit the two overlap, because one system falls under both.

How often should a credit model be checked?

Common practice is continuous monitoring for material credit models, with monthly or quarterly performance reports against agreed thresholds. Full revalidation is typically annual for the highest-risk tier and every two to three years for lower tiers, with an immediate review whenever a threshold is breached or the product, population or data changes.

Do simple scorecards need the same oversight as AI?

They need the same disciplines but not the same depth. A transparent logistic-regression scorecard is quicker to validate and explain, so a proportionate framework can apply lighter testing. It still needs an owner, an inventory entry, monitoring and documented approval, because a simple model making high-volume consumer decisions can still be highly material.

What documents do regulators ask for in a review?

Expect requests for the model inventory and risk tiering, development documentation, the latest validation report and how its findings were closed, monitoring packs, committee minutes approving use and changes, and evidence for sampled customer decisions. For bought-in models, supervisors will ask how you satisfied yourself without full access to the supplier's code.

To learn more and to discuss your needs and requirements, please contact Francesco Manitta or Yaron Shoshani at [email protected] or +44 1375 887390.

References

Check these resources out too

AI Lending Readiness: A Maturity Model for Banks

Blog Post

Governance Is Becoming a Capability: What the Mills Review Means for AI in Lending

Blog Post

How Can Banks and Vendors Adopt AI to Accelerate Software Development

Blog Post
Explore all insights

Ready to create

a financial future built on your reality?
Embed Now