Model risk management in banking is being tested by generative AI. A validator at a large bank faces an AI assistant that drafts credit memos, but the standard validation template asks for a development sample that doesn't exist. The model was trained on unseen data by a vendor. This breaks the traditional framework.

The core challenge—validating a system you cannot fully inspect—applies beyond banking to medical summarisation, legal research, and chatbots. The framework built for banks, based on risk tiering, outcome-based evaluation, robustness testing, and monitoring for silent drift, transfers to any domain where being wrong is costly.

Banks rely on statistical models for credit decisions, capital, loss forecasting, and fraud detection. Errors lead to mispriced risk, regulatory penalties, and large losses. The 2008 crisis and a 2012 trading loss showed the stakes. Regulators responded with SR 11-7 in 2011, defining model risk and requiring deliberate management. The EU AI Act extends similar expectations to high-risk AI in banking.

For generative AI, validation shifts from replication to test design. Since models cannot be retrained or fully inspected, effective challenge means designing tests to catch confident errors and monitor drift. This playbook offers a path forward for any serious AI deployment.