Model Risk Management for Generative AI in Banking: A Practitioner's Guide

Before discussing generative AI, let's answer a basic question: what is model risk management?

Model risk management is the process organizations use to identify, assess, control, monitor, and govern the risks that arise when models are used to support business decisions.

A model can create risk when it is poorly designed, based on inappropriate assumptions, implemented incorrectly, used outside its intended purpose, or produces unreliable outputs.

Traditional model risk management therefore focuses on more than model validation. It also involves governance, documentation, monitoring, controls, accountability, and understanding how a model is used.

The 2026 U.S. interagency guidance emphasizes that model risk should be managed according to factors such as the model's inherent risk, exposure, purpose, and use.

For generative AI, these principles need to be considered alongside additional risks specific to the technology.

Traditional models generally produce outputs within a defined mathematical or statistical framework.

Generative AI systems can behave differently.

The same or similar prompts may produce different responses. Outputs may be fluent but factually incorrect. Models can inherit biases from their training data. And when a bank relies on an external foundation model, it may have limited visibility into the underlying training data, model architecture, or development process.

The Bank for International Settlements has highlighted these concerns in relation to generative AI in finance, including hallucinations, inconsistent outputs, data confidentiality, cybersecurity, third-party dependencies, and explainability.

This doesn't mean generative AI cannot be used in banking.

It means the risk framework has to account for how the technology actually behaves.

A model risk management framework for generative AI should start with the use case rather than the technology alone.

1. Define the Intended Use

First, document exactly what the system is supposed to do.

Is it generating internal summaries? Assisting employees? Providing customer-facing information? Supporting credit analysis? Generating regulatory documentation?

The intended use establishes the boundaries against which the system can be evaluated.

2. Classify the Risk

Not every GenAI application requires the same controls.

A low-impact internal writing assistant may require basic governance and monitoring.

A system influencing lending, fraud decisions, investment activity, or customer outcomes requires substantially more rigorous controls.

A risk-based approach allows organizations to allocate resources according to the potential consequences of model failure.

3. Evaluate the Data

Data governance is fundamental.

Practitioners should understand:

• What information enters the system?
• Does it contain confidential or customer information?
• Where is the data stored?
• Who can access it?
• Can prompts or outputs be retained?
• How is sensitive information protected?

The BIS has specifically highlighted confidentiality and data-management concerns when financial institutions use GenAI systems.

4. Test the Model and Application

Testing should go beyond asking whether an AI model produces convincing answers.

Organizations should evaluate accuracy, consistency, bias, hallucination rates, robustness, security, inappropriate outputs, and performance under realistic scenarios.

Testing should also reflect the actual workflow in which the AI will operate.

5. Establish Human Oversight

Human involvement should be designed according to risk.

For high-impact decisions, human review may be essential. For lower-risk tasks, automated workflows may be appropriate with monitoring and escalation mechanisms.

The important point is that “human in the loop” should not simply be a checkbox. The person reviewing the output needs sufficient information, authority, and time to identify and challenge an incorrect result.

If you've worked in banking risk, you've probably encountered SR 11-7 model risk management.

SR 11-7 was issued by the Federal Reserve in 2011 and became an important reference point for model governance, covering model development, implementation, use, validation, governance, and controls.

However, practitioners should be careful when using it as a current regulatory reference.

In April 2026, the Federal Reserve, OCC, and FDIC issued revised interagency model risk management guidance through SR 26-2. The new guidance supersedes SR 11-7 and emphasizes a risk-based approach tailored to the institution's model risk profile and operational complexity.

Importantly, the revised guidance says generative and agentic AI models are outside its specific scope because they are rapidly evolving. It nevertheless states that banking organizations should use appropriate risk-management and governance practices for tools and systems not covered by the guidance.

For practitioners, the takeaway is simple: don't treat SR 11-7 as the current standalone regulatory framework for GenAI.

Instead, understand the updated guidance and consider how broader governance, risk, compliance, cybersecurity, data, and third-party controls apply to each GenAI use case.

Hallucination and Accuracy Risk

A GenAI system can generate an answer that sounds authoritative but is incorrect.

In banking, this can be particularly problematic when the output relates to regulations, customer information, financial analysis, or internal policies.

Explainability Risk

A bank may need to explain how an AI-supported outcome was produced. This can be difficult when proprietary foundation models are involved.

Bias and Fairness

AI systems can reproduce or amplify biases present in data or system design. This is especially important when AI is used in customer-facing or decision-support processes.

Data and Privacy Risk

Sensitive customer or proprietary information requires strong controls. Organizations need to understand what information is being shared with an AI system and how it is handled.

Third-Party Risk

Many banks depend on external foundation-model providers, cloud platforms, APIs, and technology vendors.

This creates additional questions around service availability, data handling, model changes, security, concentration risk, and vendor transparency.

The Financial Stability Board identified third-party dependencies, cyber risks, model risk, and governance challenges among AI-related vulnerabilities in the financial sector.

As AI adoption expands, banks are also evaluating model risk management software to support model inventories, documentation, validation workflows, monitoring, approvals, and reporting.

Software can make governance more organized, but it does not replace sound risk practices.

A platform can tell you that a model was tested.

It cannot automatically determine whether the testing methodology was appropriate for a particular GenAI use case.

For GenAI, organizations may need to combine traditional model governance platforms with AI-specific evaluation, security, data-management, and monitoring capabilities.

Before deploying a GenAI system, practitioners can ask:

Purpose: What problem is the system solving?

Impact: What happens if the output is wrong?

Data: What information does the system access?

Model: Which foundation model or AI technology is being used?

Vendor: Who provides and maintains it?

Testing: How has performance been evaluated?

Security: What prevents unauthorized access or misuse?

Monitoring: How will changes and failures be detected?

Human oversight: When must a person review or approve an output?

Documentation: Can the organization demonstrate how the system is governed?

These questions can form a practical starting point for an AI governance program.

GSDC’s Certified Gen AI in Finance and Banking Certification helps professionals build practical knowledge of generative AI applications and risk considerations across financial services. 

The Certified Gen AI in Finance and Banking Certification covers key areas such as GenAI use cases, AI-driven financial workflows, model and data risks, responsible AI, governance, compliance, and implementation strategies. It is designed to help banking and finance professionals understand how to evaluate AI opportunities while addressing risks around accuracy, privacy, security, bias, and third-party dependencies. 

By combining GenAI knowledge with finance-focused applications, the certification supports professionals looking to contribute to responsible AI adoption and transformation across modern financial institutions.

The future of generative AI in finance & banking is unlikely to be defined by a single model or application.

Instead, financial institutions are likely to use different AI systems for different purposes, with governance determining where and how those systems can operate.

The BIS has emphasized that banks need to manage AI-related risks while also adapting their governance approaches as technology develops.

For practitioners, this means staying current is essential.

The generative AI practitioner's guide cannot simply be a list of tools or prompts. It needs to cover use-case assessment, risk classification, data governance, testing, validation, monitoring, security, third-party risk, and accountability.

That is what turns experimentation into responsible implementation.

Generative AI can create significant opportunities across banking, but its value depends on how responsibly it is deployed. Effective model risk management for GenAI requires more than validating a model it requires understanding the use case, data, technology, vendor, controls, and potential impact of errors. As regulatory expectations and AI capabilities continue to evolve, practitioners need governance approaches that are flexible enough to accommodate new technologies while maintaining accountability. Whether you are exploring generative AI in finance, building an AI governance function, or developing skills through generative AI certification, the goal remains the same: enable innovation while keeping risk visible, measurable, and managed.