Mai departeUrmătorul ghid
Cadrul de management al riscului NIST AI
Societate
Societate GHID
Model de management al riscului (SR 11-7) și AI
SR 11-7 is the Federal Reserve's 2011 supervisory guidance on model risk management, issued jointly with OCC Bulletin 2011-12.
Pe această pagină4 minute de citit
Prezentare generală
It expects banks to develop, validate, govern and monitor the models they rely on. Banks now apply it to machine learning and large language models, which strains traditional validation because these models are often opaque, supplied by vendors and non-deterministic. The guidance matters because a bank using AI for credit, fraud, compliance or customer service has to show supervisors it understands and controls how those models can fail.
Scufundare în profunzime
SR 11-7 was issued in April 2011 by the Federal Reserve together with the OCC, and the FDIC adopted it in 2017. It defines a model broadly: a quantitative method, system or approach that applies statistical, economic, financial or mathematical theories to turn input data into quantitative estimates. A model has an input part, a processing part and a reporting part. Model risk comes from two sources: fundamental errors in the model, and using a sound model incorrectly or outside its intended purpose. The guidance rests on three pillars. The first is sound development, implementation and use. The second is validation, which has three core elements: evaluating conceptual soundness, ongoing monitoring (including process verification and benchmarking), and outcomes analysis such as back-testing. The third is governance: board and senior management oversight, written policies, a complete model inventory, and documentation detailed enough that someone unfamiliar with the model could understand how it works. Throughout, the guidance calls for "effective challenge," meaning critical review by people who are objective, informed, competent and influential enough to force changes. Vendor models get no exemption. Banks are expected to get appropriate documentation from vendors. Where proprietary details are withheld, banks should rely more on sensitivity analysis, benchmarking and outcomes testing. A common misconception is that SR 11-7 doesn't reach AI because it predates modern machine learning. Its definition is technology-neutral, and supervisors have treated AI as within scope. Banks usually either classify generative AI tools as models or govern them under a broader AI risk framework that uses the same validation principles. Related references include the OCC's 2021 Comptroller's Handbook booklet on model risk management and the NIST AI Risk Management Framework, released in January 2023. For credit decisions, adverse action notice requirements under the Equal Credit Opportunity Act still apply when the model is complex.
Impact strategic
Risc și siguranță
Daunele catastrofale și cotidiene ale IA depind de cine înțelege riscurile și cine poate acționa.
Decizii mai clare
Educația publică și profesională influențează dacă o politică puternică de siguranță este posibilă din punct de vedere politic.
Tăierea hype-ului
Explicațiile clare reduc captarea de hype, PR de laborator și teatrul vag de etică.
The Future of Model Risk Management (SR 11-7) and AI
Banks are expanding model inventories and building evaluation methods for generative AI. Supervisors have discussed AI governance in speeches and requests for information, but whether formal updates to model risk guidance will come, and what they would say, remains uncertain. The core principles in SR 11-7 (know the model's purpose, test it independently, document its limits, monitor it over time) apply well to LLMs even where specific methods are still being worked out. Expect the most attention on vendor transparency and continuous monitoring.
Implementare în lumea reală
A bank adds a vendor LLM that summarizes customer complaints to its model inventory, assigns it a risk tier, and gives it to an independent validation team before production use.
Validators build a labeled set of several hundred complaints to measure how often the LLM's summaries leave out an issue that must be escalated for regulatory reasons. They set an acceptable error threshold before approving the tool.
A machine learning credit model goes through outcomes analysis against actual defaults, plus fair lending testing. Explanation methods help produce the specific adverse action reasons lenders must give applicants.
A monitoring dashboard tracks shifts in input data and samples LLM output quality every week. When the vendor releases a new model version, the dashboard triggers a targeted revalidation.
Riscuri și balustrade
Tratarea riscului existențial ca SF în timp ce capacitatea se agravează.
Confuză siguranța produsului de suprafață cu alinierea sub autonomie ridicată.
Lăsând audiențe non-engleze și neexperte doar surse de calitate scăzută.
Foaia de parcurs de implementare
Separați riscurile de deteriorare a produsului, utilizare greșită și pierderea controlului / dezaliniere.
Întrebați ce dovezi v-ar schimba punctul de vedere cu privire la termene și severitate.
Preferați sursele primare și evaluările concrete față de afirmațiile de marketing.
Identificați o singură cale de acțiune: carieră, politică, finanțare sau abilități - nu numai conștientizare.
Continuați să explorați
Free newsletter
Get the daily AI briefing
Three verified AI stories every weekday morning, written in plain English. Free forever, no ads.
One email each weekday. Unsubscribe in one click. We never sell or share your address.
Test yourself
Take the Model Risk Management (SR 11-7) and AI quiz
Instant feedback on every answer, and a shareable certificate with a verifiable ID once you pass a course.
Support free AI education. AI Understanding is a 501(c)(3) nonprofit — no ads, no paywall, ever. Make a donation
Întrebări frecvente
What is Model Risk Management (SR 11-7) and AI?
SR 11-7 is the Federal Reserve's 2011 supervisory guidance on model risk management, issued jointly with OCC Bulletin 2011-12. It expects banks to develop, validate, govern and monitor the models they rely on. Banks now apply it to machine learning and large language models, which strains traditional validation because these models are often opaque, supplied by vendors and non-deterministic. The guidance matters because a bank using AI for credit, fraud, compliance or customer service has to show supervisors it understands and controls how those models can fail.
Which OCC document was issued alongside the Federal Reserve's SR 11-7 in 2011?
The OCC issued the same guidance as Bulletin 2011-12, so the two documents are often cited together.
What are the three core elements of validation under SR 11-7?
Validation covers whether the design is sound, whether the model keeps performing as intended, and how its outputs compare with actual results.
What does SR 11-7 require for review to count as "effective challenge"?
Effective challenge means critical analysis by capable, independent people whose findings actually lead to changes.
How should a bank handle a vendor model whose proprietary details are withheld?
Vendor models are still validated. When internal details are unavailable, testing of behavior and outputs carries more weight.
According to the guide, which of these is part of an LLM application's model boundary for change management?
Prompts, retrieval data, parameters, tools and guardrails all shape the output, so changing them counts as a model change.
Continuați să învățați
Ghiduri conexe
Mai multe ghiduri alese pentru acest subiect