When the Model Said It Was Fine

Financial services built the most mature model risk governance discipline of any industry sector — three decades of regulatory pressure, crisis response and accumulated practice, resting on board accountability, backtesting and stress testing. That discipline is being outpaced. AI development compresses model-build timelines from months to weeks while validation cycles stay where they were; some systems modify their own parameters between review cycles; agentic systems close the human gap every governance mechanism in the discipline is built around. In April 2026 the US revised its founding model risk text, SR 11-7, to explicitly exclude generative and agentic AI from scope. European supervisors have not excluded the gap — they have answered it by restating frameworks written before these systems existed.

The central claim: AI does not merely strain Model Risk Management. In practice and in regulatory intent, it does not yet reach it — and no jurisdiction examined here has redesigned for that fact.

Every model risk framework in financial services lands, in the end, on one signature. A named Senior Manager or Chief Risk Officer attests — initially and then annually — that the institution's model risk framework is in place and effective. That attestation implicitly claims five things: that the institution knows what models it is running, that those models behave as validated, that validation is current in substance and not merely in date, that no model takes consequential decisions without a human review point, and that independent-challenge expertise remains present in the institution. The article's argument is that current AI deployment conditions give reasonable cause to doubt all five — which means the person signing can be sincere, and still wrong.

Twenty-one pages, structured for a reader who understands financial services governance but wants the AI-era gap named plainly:

• What Model Risk Management was built to do — the regulatory genealogy from the 1996 Basel Market Risk Amendment through SR 11-7, Solvency II, and the conduct-of-business rulings that extended it to fairness and automated decisions
• Why financial services developed the discipline before any other sector: leverage, model centrality, and systemic risk with an implicit state guarantee
• Five specific ways AI changes the conditions the frameworks assume — speed and "vibe coding," self-modification, direct-to-execution, documentation decay, and the classification problem
• Three regulatory postures compared side by side: the US's explicit exclusion under SR 26-2, the UK's technology-agnostic incompleteness under SS1/23, and Europe's reabsorption of AI into existing requirements
• What the same failure modes look like once they reach healthcare, criminal justice, energy and utilities, and public sector algorithms — and what each side can learn from the other
• The accountability question: what an MRM attestation implicitly claims, and why current conditions give the named individuals who sign it reasonable cause for doubt
• A five-point work programme for the model risk management profession to examine next

This article was co-authored for joint publication rather than commissioned as a client briefing, and the production discipline follows from that. The regulatory positions the argument depends on — the EIOPA Opinion, the ECB's February 2026 keynote, the scope of PRA SS1/23, the Durham HART validation study, and the ENTSO-E final report on the Iberian blackout — were each read in full against the primary publication during review, not taken from summaries. Foundational legal and regulatory sources — SR 11-7, the Solvency II Directive, the CJEU rulings, the EU AI Act — are drawn from the established legal record. A small number of secondary industry analyses are cited for context and industry framing only; they are not treated as primary evidence for any claim in the article.

SMF holders, Chief Risk Officers, and board risk committee members who carry personal accountability for model risk in a UK or European financial institution — and practitioners in healthcare, criminal justice, energy, and public sector roles now encountering the same governance problems for the first time, without the accumulated discipline financial services has to bring to them.