Model risk management (MRM) is the work of checking that the models a bank uses still work as they should, and recording the evidence. A model, here, is any calculation or AI system that the bank uses to make decisions. Examples include a credit score model that approves loans, a model that measures how much the bank could lose, and a model in AML transaction monitoring that flags suspicious payments. Model risk is the risk that a wrong or outdated model leads to bad decisions.
MRM software keeps a list of every model in the bank, called the model inventory. For each model, it records who built it, what data it uses, who approved it and when it was last tested.
Here is how it works in general. A team that did not build the model tests it before it is used. This is called independent validation. After that, the software keeps watching the model's results. It compares what the model predicted with what really happened. If the results drift away from what is expected, it raises a warning. The model is then fixed, retrained or replaced.
Take, for example, a loan approval model in a credit decision engine that was built two years ago. At that time, the model expected about 3% of approved borrowers to miss payments. Now, the software finds that 6% of them are missing payments. Borrowers' behaviour has changed. The software warns the model's owner. The owner must retrain the model or explain the difference.
Regulators ask banks to show this evidence. In the United States, supervisors have long issued formal guidance on model risk. In India, the RBI published draft principles for managing the risk of credit models in August 2024. In June 2026, it published wider draft guidance that covers all models, including AI models. Neither is final yet. The evidence is often shared with regulatory reporting and audit teams.
AI models make this work harder, because their reasons are harder to explain. A model can also give wrong answers with confidence. The page on hallucination explains this for language models.