Semi-Annual Model Risk Committee Pack — AI & Credit Model Governance
This semi-annual Model Risk Committee (MRC) pack provides deep-dive governance over the firm's model inventory, with particular focus on AI/ML models used in credit decisioning, pricing, and customer-impacting decisions. The cadence complements quarterly operational MRC reviews by providing a strategic checkpoint aligned with PRA SS1/23 Model Risk Management Principles, which became effective May 2024 and require firms to maintain board-approved model risk appetite, comprehensive model inventories, and proportionate validation regimes. The pack also addresses convergence with the EU AI Act and EBA Guidelines on AI Act compliance for credit institutions, ensuring that high-risk AI systems are appropriately classified, documented, and monitored. The MRC is responsible for approving model tiering methodology, reviewing validation findings on Tier 1 models, sanctioning model use restrictions, and escalating systemic model risk concerns to the BRC. Semi-annual cadence allows sufficient depth for substantive review of validation reports, performance monitoring trends, and governance maturity, while annual cadence would be insufficient given the pace of AI regulatory development and the SMF accountabilities of the SMF4 (Chief Risk Officer) and model owners.
7
Required Materials
6
Key Questions
1
Related Themes
- Model Inventory & Tiering Report
- Tier 1 Model Validation Findings Summary
- AI/ML Model Performance Monitoring Dashboard
- Model Risk Appetite Compliance Report
- SS1/23 Implementation Status Tracker
- EU AI Act High-Risk System Classification Register
- Independent Validation Function Capacity Plan
- Does our model inventory completeness and tiering methodology meet PRA SS1/23 expectations, and can we evidence this to supervisors on request?
- For our credit decisioning AI models, can we demonstrate explainability sufficient to satisfy ECB and EBA supervisory expectations and to defend adverse action decisions?
- Which models are showing performance degradation or drift, and are mitigation actions (recalibration, restriction, decommissioning) proportionate and timely?
- How are we governing the lifecycle of vendor-supplied and third-party AI models where we have limited visibility into training data and methodology?
- Is our independent model validation function adequately resourced and independent to deliver against the Tier 1 validation pipeline?
- What lessons should we take from the AI model governance failure scenario, and where would our controls have failed in a similar event?