From model risk to AI risk: building trust in intelligent systems

No. Organisations should first determine whether an AI capability meets their definition of a model. Productivity tools used to support individual tasks may require governance and controls, but not necessarily full model risk management requirements. AI capabilities that influence business decisions, customer outcomes, risk assessments or financial reporting should typically be considered for inclusion within the model inventory.

Yes. Most firms are adapting existing MRM frameworks rather than creating standalone AI risk frameworks. However, additional controls are often required around explainability, fairness, model drift, continuous monitoring, third-party dependencies and AI-specific governance considerations.

Common challenges include incomplete inventories, inconsistent model tiering, poorly defined risk appetite, insufficient specialist skills to effectively challenge AI models and underestimation of aggregate AI risk across multiple use cases.

Yes. Outsourcing model development does not outsource accountability. Firms remain responsible for understanding model limitations, governance arrangements, monitoring requirements and residual risks, even when an external vendor provides the model.

Accountability should remain with the business owner responsible for the model's outcomes, supported by risk, compliance, technology and independent validation functions. The use of AI does not remove management accountability for decisions or customer outcomes.