Your model-risk program doesn't cover your GenAI

By Barry Middlebrook · Middlebrook Data & AI Governance

Banks have spent a decade building disciplined model-risk programs — inventories, validation, monitoring, documentation, all the machinery of SR 11-7. It works. The problem is that the AI you're deploying right now mostly falls outside it — and the regulators have just confirmed it.

The gap is now official

The OCC's revised model-risk guidance explicitly excludes generative and agentic AI from its scope. SR 11-7 was written for deterministic, relatively static models — not for probabilistic systems that generate language, reason over your data, and change behavior as they're updated. So your copilots, your RAG assistants, and the agents quietly wired into reporting workflows sit in a governance no-man's-land: too consequential to ignore, but outside the framework your second line actually runs.

Your SR 11-7 program didn't disappear — it just doesn't reach the AI you're actually deploying.

Why "it wasn't in scope" won't fly

The moment that AI touches credit, reporting, or a customer decision, the absence of governance becomes your exposure — not the tool's. "The model wasn't in our MRM scope" is not a defense to an examiner. And the pressure is converging from every direction:

• DORA now treats AI as part of ICT risk — supervisors expect controls at the start of the model lifecycle, not bolted on after.
• The EU AI Act tiers credit-scoring and risk-assessment AI as high-risk, with conformity obligations and penalties up to €15M or 3% of global turnover.
• US supervisors — including the Federal Reserve — are publicly signaling that AI in the financial system is squarely a safety-and-soundness matter.

None of this waits for a single deadline. The work is coming regardless; the only question is whether you lead it deliberately or scramble through an exam.

The fix: extend model risk, don't reinvent it

The good news is that you don't need a parallel rulebook. You need to extend the discipline you already have to the systems it wasn't written for:

• Inventory every AI use touching reporting, credit, or customers — including the shadow ones. You can't govern what you haven't catalogued.
• Risk-tier each use — not every model needs the same scrutiny; the ones near a regulated decision do.
• Validate and monitor as models that drift — extend validation, set quality SLAs, and watch for data and model drift.
• Govern the data beneath it — a semantic layer and lineage so the AI reasons over certified definitions, not raw tables, and every output can cite its source.
• Keep humans on high-stakes outputs, and evidence as you operate — the audit trail that proves all of the above, built continuously rather than reconstructed in a pre-exam fire drill.

This is governance a CFO and an examiner already understand — model risk, extended to AI. It's exactly the gap a fractional Head of AI Governance is built to close: one accountable owner extending your control environment to cover the AI, without the cost of a permanent hire.