Model Risk Management Meets Generative AI: Use the Rulebook You Already Have

Briefing note. Generative artificial intelligence (AI) does not need a new rulebook in a bank. It needs the existing one applied with discipline. United States supervisors set the core expectation in 2011: effective challenge [1]. The Office of the Superintendent of Financial Institutions (OSFI) published its final Guideline E-23 last month, with AI methods explicitly inside the model definition and an effective date of May 1, 2027 [2].

Two definitions, one practical question

The first question for any generative AI use is whether it is a model. The answer depends on which definition applies.

SR 11-7 is the Supervision and Regulation letter on model risk issued by the Federal Reserve and the Office of the Comptroller of the Currency. It defines a model as “a quantitative method, system, or approach that applies statistical, economic, financial, or mathematical theories, techniques, and assumptions to process input data into quantitative estimates” [1]. A drafting assistant produces text, not quantitative estimates. Read narrowly, much generative AI use sits outside that definition.

E-23 is wider. It defines a model as “an application of theoretical, empirical, judgmental assumptions or statistical techniques, including AI/ML methods, which processes input data to generate results” [2]. ML stands for machine learning. Note the word results, not estimates. E-23 also adopts the definition of an AI system from the Organisation for Economic Co-operation and Development, which covers systems that generate content [2].

My working rule is simple. Govern the use, not the technology label. Ask what the output drives.

Triage by what the output drives

E-23 supports this approach. It asks institutions to keep an enterprise inventory of models with non-negligible inherent risk [2]. Each model gets a risk rating built on quantitative and qualitative factors, including business use, complexity or level of autonomy, reliability of data inputs, customer impacts and regulatory risk [2]. A negligible-risk category is allowed, with a robust process to approve and track exemptions [2].

Effective challenge, applied to a generative model

SR 11-7 describes effective challenge as “critical analysis by objective, informed parties who can identify model limitations and assumptions and produce appropriate changes” [1]. It depends on incentives, competence and influence [1]. None of that changes for generative AI. What changes is the evidence.

SR 11-7 names three core elements of validation: conceptual soundness, ongoing monitoring and outcomes analysis [1]. Each translates directly:

• Conceptual soundness. Document the design: the foundation model and its version, the retrieval sources, the system instructions, the guardrails and the human review step.
• Ongoing monitoring. Sample outputs on a schedule. Score them against a labelled test set. Track confabulation, the term the National Institute of Standards and Technology (NIST) in the United States uses for confidently stated but false content [3].
• Outcomes analysis. Compare assisted results with an unassisted human baseline on the same cases.

Vendor models are still your models

Most generative AI in banks arrives through a vendor. OSFI and the Financial Consumer Agency of Canada (FCAC) reported that most financial institutions rely on third-party providers for AI models and systems. The same report notes that explainability is harder for generative AI than for traditional models [4].

SR 11-7 already covers this. Banks should require developmental evidence, testing results and stated limitations from vendors, and they are expected to validate their own use of vendor products [1]. Where code is not available, a bank “may have to rely more on sensitivity analysis and benchmarking” [1]. E-23 says externally developed models should be rated on a standalone basis [2].

OSFI’s cover letter closes a door some institutions hoped would stay open. Stakeholders asked for a grace period to validate third-party model updates after deployment. OSFI did not add one, although institutions may still use an exceptions policy for limited and specific applications before validation is complete [5].

That matters because foundation models change. E-23 lists model modifications and significant data changes among the events that should prompt a review [2]. A provider’s version change is a modification. Contracts should require notice of it.

A control list for the next 19 months

E-23 takes effect on May 1, 2027 [2]. That leaves about 19 months. A practical sequence:

1. Extend the model identification survey to generative AI, including vendor features switched on inside existing platforms.
2. Triage every use by what its output drives, and record the rationale.
3. Assign a provisional risk rating to each use that carries non-negligible risk.
4. Record the foundation model and version in the inventory. Treat version changes as review triggers.
5. Build a labelled test set for each rated use, and set breach thresholds.
6. Define the human review step, then measure whether it actually happens.
7. Write vendor evidence requirements into contracts: test results, limitations and change notices.
8. Write the exceptions policy before you need it, with scope limits and an expiry date.
9. Report inherent and residual model risk to senior management on a fixed cycle.

Who owns what

The chief risk officer owns the definition, the rating approach and the independence of review. The chief information officer owns the inventory feed, the version records and the monitoring data. Neither can do it alone. Programs move fastest when both sign the same plan.

Across nearly a decade of enterprise technology work in large global banks, my view has stayed consistent. New technology rarely needs new governance principles. It needs the existing principles applied early, with evidence that fits the technology.

Generative AI is new. Model risk discipline is not. Banks that apply SR 11-7 habits now will meet E-23 in 2027 without a scramble.

References

1. Board of Governors of the Federal Reserve System and Office of the Comptroller of the Currency, “Supervisory Guidance on Model Risk Management,” SR Letter 11-7 (OCC Bulletin 2011-12), Apr. 4, 2011.
2. Office of the Superintendent of Financial Institutions, “Guideline E-23: Model Risk Management (2027),” Sept. 11, 2025.
3. National Institute of Standards and Technology, “Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile,” NIST AI 600-1, July 2024.
4. Office of the Superintendent of Financial Institutions and Financial Consumer Agency of Canada, “OSFI-FCAC Risk Report: AI Uses and Risks at Federally Regulated Financial Institutions,” Sept. 24, 2024.
5. Office of the Superintendent of Financial Institutions, “Guideline E-23: Model Risk Management (2027), Letter,” Sept. 11, 2025.