AI in Risk8 min read

Model Risk Management for AI: SR 11-7 & SS1/23

By Jonas Adam Mohamed Osman, known as Yonas Osman

CEO of Quantica Risk

60 Rue François Ier, 75008 Paris, France

Published 15 October 2026

How SR 11-7 and the PRA's SS1/23 extend to AI and machine-learning models, and what firms must add to existing validation frameworks.

Executive answer

SR 11-7, issued by the Federal Reserve and OCC in 2011, predates modern machine learning but its principles, independent validation, ongoing monitoring, and clear documentation of limitations, translate directly to AI models and require only targeted extension. The Bank of England's SS1/23, published in 2023, is the first major supervisory text written with machine learning explicitly in mind, codifying expectations around explainability, data quality, and governance that UK firms must now evidence in their model risk frameworks.

Both frameworks converge on the same core idea: a model's complexity should be matched by the rigour of its validation and the clarity of its governance. Firms running credit scoring, fraud detection, or algorithmic trading models built with gradient boosting or neural networks cannot treat SR 11-7 or SS1/23 compliance as satisfied by frameworks designed for regression-based models; the testing depth and documentation detail both need to scale with model opacity and potential impact.

What SS1/23 adds for machine learning

SS1/23 explicitly broadens the definition of a model to capture a wider range of quantitative methods, which pulls many previously unregulated machine-learning tools into formal model risk governance for the first time. It also raises expectations on explainability, requiring firms to demonstrate they understand model behaviour well enough to challenge it effectively, and on data quality, given machine-learning models' sensitivity to training data composition and drift over time.

Firms must also maintain a comprehensive model inventory with risk-based tiering, an area many institutions historically under-resourced for lower-materiality models that nonetheless aggregate into meaningful firm-wide risk. SS1/23 pushes boards toward holding an aggregate view of model risk across the inventory rather than assessing each model in isolation, which has operational implications for how model risk committees report to boards and how risk appetite statements are framed.

Practical extensions to existing frameworks

Firms extending SR 11-7 or equivalent frameworks for AI typically add explainability testing, stability testing under data drift, and challenger model benchmarking as standard validation components, alongside bias and fairness testing where the model affects individuals. Version control becomes more demanding too, since machine-learning models often retrain on refreshed data on a schedule, requiring a defined threshold for when retraining constitutes a new model requiring full revalidation versus routine recalibration.

Ongoing monitoring plans need machine-learning-specific triggers: population stability index thresholds, feature drift alerts, and performance degradation checks run more frequently than the annual reviews common for traditional models. Independent validation teams need practitioners literate in machine-learning methods, which is itself an organisational challenge many firms are still addressing through hiring or targeted training of existing validators.

Conclusion

The direction of travel across US, UK, and EU supervisory text is consistent: AI and machine-learning models are models first, and existing model risk management obligations apply in full, with targeted additions for explainability, drift, and fairness. Firms that build AI governance as an extension of SR 11-7 or SS1/23 frameworks, rather than a bolt-on compliance exercise, will find the transition to newer AI-specific rules like the EU AI Act considerably smoother.

Jonas Adam Mohamed Osman (Yonas Osman), CEO of Quantica Risk, approaches AI model risk by extending the same validation rigour used for traditional models, adding explainability and drift testing as core components rather than treating them as optional extras.

Primary sources

SR 11-7SS1/23model riskAI governance