Model Risk Management for AI: Updating SR 11-7 for the Generative Era

Model Risk Management for AI: Updating SR 11-7 for the Generative Era

When the regional commercial bank's Model Risk Management (MRM) team walked the floor one morning, they didn't expect to find a "model" drafting credit memos. They found three.

- A generative copilot that helped junior credit officers turn meeting notes into first-draft memos.
- A customer-facing chatbot fielding deposit questions and product eligibility inquiries.
- An internal retrieval-augmented generation (RAG) assistant relationship managers used to pull clauses from contracts and previous loan decisions.

None of these fit the validation playbook the bank had built around SR 11-7 and OCC 2011-12 - documents designed for deterministic statistical models and scorecards. The outputs were probabilistic, context-sensitive, and sometimes persuasive enough to be dangerous: hallucinated numbers, invented precedents, and confidently wrong policy interpretations. Yet the business functions using them reported faster turnaround, higher staff productivity, and better customer experience.

The bank's MRM team faced a choice familiar to many financial firms: block the tools and stall the business, or redesign model risk management so it could govern generative systems without killing their value. They chose the second route - and built a program examiners later described as "well-tailored to the risks of generative AI" while allowing the business to keep moving.

Here's how they updated SR 11-7 thinking for the generative era, what changed when models became non-deterministic, which classic validation activities still matter, and what new practices are now essential.

Why SR 11-7 still matters - and why it isn't enough

SR 11-7 and OCC 2011-12 remain foundational. They emphasize governance, independent validation, model inventory, documentation, and lifecycle controls - all of which are necessary for LLMs and agentic systems. Regulators' expectations around traceability, validation rigor, and independent oversight didn't dissolve because models started using transformers.

But generative AI changes the shape of the risk:

- Outputs are non-deterministic: identical inputs can yield different plausible answers.
- Models mix knowledge and reasoning with retrieval and heuristics (RAG), making root-cause analysis harder.
- Business value often comes from creative synthesis rather than narrow prediction - the outputs require different correctness criteria.
- Risks include hallucination, prompt injection, data leakage, and emergent behaviors that aren't captured by traditional performance metrics.

SR 11-7 gives you the governance skeleton. To use it for LLMs you need new muscle: evaluation tooling, red teaming, human-in-the-loop controls, and continuous monitoring designed for open-ended outputs. Successful programs marry the old and new - preserving independence, documentation, and lifecycle control while adding fresh validations that reflect generative behavior.

The bank's redesign: four straightforward moves that made the difference

The bank translated SR 11-7's principles into practical controls for generative systems. Their redesign focused on four operational moves executives can replicate:

1. Define acceptable use and risk tiers
- They mapped every AI instance to a use-case taxonomy (customer-facing, credit decision assistance, internal knowledge, regulatory reporting).
- Each use case was assigned a risk tier driven by consumer impact, confidentiality of data, and regulatory exposure.
- Acceptable use policies and guardrails were defined by tier (e.g., low-risk internal copilots could have lighter controls than customer-facing credit guidance systems).

2. Build golden-set evaluations
- For each critical use case, MRM worked with business SMEs to create "golden sets": curated inputs and human-labeled expected outputs that capture edge cases, regulatory constraints, and adversarial prompts.
- Golden sets measured more than accuracy: factuality, hallucination rate, policy compliance, and an actionable "trust score" for end users.

3. Institute shadow testing before production
- Models ran in shadow (parallel) mode on live traffic for several weeks. Outputs were logged and scored against golden sets and human reviewers without being revealed to customers or used in decisions.
- Shadow testing let teams observe real-world behavior and measure degradation or unsafe behaviors before any production exposure.

4. Require ongoing drift monitoring and incident thresholds
- The bank set automated monitors for input-distribution shift, output-property drift (e.g., hallucination frequency or increased off-policy responses), latency and throughput, and third-party model version changes.
- Thresholds triggered escalations: immediate human review, temporary rollback, or formal incident response.

Examiners later praised this approach because it preserved the core SR 11-7 expectations - independent validation, documentation, and change control - while adding necessary new practices for generative models.

What changes when models are non-deterministic

Non-determinism alters how you validate, monitor, and control models:

- Reproducibility: You can't rely on single-run tests. Validation becomes statistical - sampling-based evaluations, confidence intervals, and repeated trials to estimate variability.
- Metrics expand: Traditional metrics (AUC, RMSE) are insufficient. You need fidelity/factuality metrics (hallucination rate), retrieval accuracy (for RAG), response safety, and human-centered metrics like task completion and time saved.
- Root-cause analysis is harder: Failures may come from the base model, fine-tuning data, embedding quality, retrieval corpus freshness, or prompt engineering. Validation must instrument each layer.
- Continuous evaluation matters: Performance can change when vendors update models, or when retrieval corpora shift. Static validation at deployment isn't enough - monitoring must be continuous.

Non-determinism also demands clearer human roles. The bank turned to human-in-the-loop (HITL) policies for higher-risk tiers - humans would always review or co-sign critical outputs, and there were explicit thresholds where human arbitration was required.

Four validation activities that still apply (and how to adapt them)

SR 11-7's validation essentials still matter, but you must change their implementation:

1. Model conceptual soundness
- Still essential: document purpose, assumptions, and limitations.
- Adaptation: include prompt design, retrieval architecture, and data sourcing assumptions. Document what the model can and cannot do (e.g., "provides drafting assistance, not legal advice").

2. Data and input quality controls
- Still essential: data lineage, labeling standards, and input preprocessing.
- Adaptation: extend lineage to retrieval corpora and prompt templates. Verify that private or regulated data cannot be exposed through generations.

3. Performance testing and benchmarking
- Still essential: systematic testing against benchmark tasks.
- Adaptation: use golden-sets, multi-run sampling, and multi-dimensional metrics (factuality, fluency, safety, bias). Include end-to-end task measures (error rate in credit memo drafts, time to final approval).

4. Independent review and governance
- Still essential: independent validation team separate from development.
- Adaptation: validation teams must include prompt engineers, retrieval experts, SMEs, and an adversarial testing function. Independent reviewers should have access to system prompts, embeddings, and retrieval logs - not just final outputs.

New validation and governance activities you didn't need before

Generative AI requires a set of controls absent from the classic MRM playbook:

- Red teaming and adversarial testing
- Simulate jailbreaks, prompt injection, and adversarial retrieval. Test for data exfiltration, policy evasions, and deceptive outputs.
- The bank ran quarterly red-team drills with legal, security, and product SMEs.

- Evaluation suites and continuous scoring
- Build automated, reproducible eval pipelines that run golden-set tests and adversarial cases on every model or vendor update.
- Integrate eval results into CI/CD gates and change-control approvals.

- Human-in-the-loop controls and role-based approval workflows
- Define which outputs require human approval (e.g., any credit memo that triggers exceptions).
- Implement UX that surfaces model confidence and provenance for human reviewers.

- Retrieval governance and provenance
- For RAG systems, govern the retrieval corpus: freshness, metadata tagging, access controls, and provenance tracking.
- The bank enforced source whitelisting and tagging so relationship managers could see where each clause was pulled from.

- Ongoing drift and safety monitoring
- Monitor not just performance but safety signals: hallucination rate, policy deviations, user complaints, and unusual prompt patterns.
- Set actionable thresholds: auto-disable, degrade to human-only mode, or trigger remediation.

- Vendor change control and supply-chain transparency
- Require vendors to notify material model changes and provide model cards, versioning, and access to baseline evaluation artifacts.
- Include contractual obligations for incident response and forensics support.

Governance as an enabler of speed, not a roadblock

The bank's story shows governance can be a productivity multiplier. Before redesign, every BU was experimenting independently with little oversight - quick wins, slow mitigation. After the MRM team created scalable, risk-graded controls, the bank saw three benefits:

- Faster safe adoption: business units could deploy low-risk tools quickly under a streamlined approval process, while high-risk tools followed stricter gates.
- Clear accountability: defined owners for model decisions, monitoring, and incident response reduced finger-pointing.
- Regulator comfort: examiners found the program aligned with SR 11-7 principles and appreciated the bank's practical approach to new risks. The bank retained the benefits of generative AI without surprising supervisors.

Regulatory frameworks can help guide priorities: map your program to SR 11-7 governance expectations, use NIST AI RMF for risk-management practices, and watch EU AI Act obligations for customer-facing or high-risk systems. ISO/IEC 42001 (when applicable) can be a useful target for an organizational AI management system. But these frameworks are guardrails - you still need business-specific golden-sets, red-team playbooks, and pragmatic human controls.

A practical 90-day readiness move for executives

If you're the C-suite or board member asking "where do we start?", here's a concrete, time-boxed move:

- 0-30 days: Inventory and classify. Map all generative AI instances and pilots. Classify by business impact, data sensitivity, and customer exposure into low/medium/high risk.
- 30-60 days: Build golden sets for the top three high-impact use cases. Engage SMEs to label expected outputs and edge cases.
- 60-90 days: Run shadow testing and deploy basic drift monitors and red-team prompts for those use cases. Define human-in-the-loop thresholds and a playbook for incidents.
- Deliverable at 90 days: A one-page risk/benefit dashboard, golden-set results, monitoring baseline, and an approved escalation flow.

This is the readiness move that made the bank's board comfortable: a short, measurable program that creates a defensible baseline and buys you time to scale governance.

Conclusion - one clear takeaway

Generative AI doesn't invalidate SR 11-7; it stretches it. The right approach preserves independent validation and lifecycle controls while adding new validation trenches - golden-set evaluations, shadow testing, continuous drift monitoring, red teaming, and human-in-the-loop governance. That's what being AI-economy-ready looks like: protecting customers and the franchise without choking off innovation.

Concrete readiness move: start by classifying your generative use cases and build golden-set evaluations for the top three. Run them in shadow with drift monitors and a red-team run. Those steps convert abstract regulatory expectations into operational safety - and keep the business moving.