Does it apply only to machine learning?

No. Statistical, mathematical and other models can create model risk.

Is a simpler model always lower risk?

Not necessarily. Its assumptions and use may still be unsuitable or consequential.

Is monitoring a substitute for initial review?

No. Monitoring and pre-use assessment address different parts of the lifecycle and should inform each other.

AI Glossary / Governance, ethics and safety / Intermediate

Model risk management

Definition

Model risk management is the process of identifying, assessing, reducing and monitoring risks arising from models and their use. It considers both weaknesses in a model and the consequences of applying its results in an unsuitable or misunderstood way.

What it means

A model simplifies reality. Its assumptions, data and implementation can be wrong or incomplete, and a useful model can still be used beyond the conditions for which it was evaluated. Risk therefore depends on the decision the model supports, not only on its average predictive error.

The term is especially established in financial services, but its central questions are useful in many organizations. This entry gives a general explanation rather than treating one sector's supervisory guidance as a universal rule.

Model risk management is related to model governance. Governance establishes responsibilities and decision processes; risk management uses those arrangements to assess specific weaknesses, consequences and responses. Neither means that a model has become risk-free.

How it works

Maintain an inventory that connects models to their uses and owners. Assess the importance of each use, the model's complexity, its uncertainty and the consequences of incorrect or misapplied results.

Review the model's conceptual basis, data and implementation, then examine performance under relevant conditions. Appropriate independent challenge can expose assumptions that the development team has overlooked. The depth and form of review should fit the context rather than follow the same ritual for every model.

Use restrictions, monitoring, contingency arrangements or model changes to address identified concerns. Record unresolved limitations and the decision about whether to accept them. Reassess when the model, its inputs or its use changes. Monitoring should connect to actions and responsible roles, not simply produce a score that nobody interprets.

Three practical examples

A retailer examines how forecast errors affect stock availability before allowing a model to drive automatic replenishment.
A planning team tests whether a model remains useful under conditions outside the ordinary historical range.
An organization limits a model to advisory use while a known weakness in its input data is being resolved.

Think of it this way

Think of using a weather forecast to plan different activities. The same uncertainty may be acceptable when choosing a picnic time and unacceptable when coordinating a more consequential operation without further safeguards.

The analogy emphasizes the relationship between uncertainty and use. Model risk management involves evidence, responsibilities and controls specific to the actual decision, rather than a single universal tolerance for forecast error.

Worked example

Equal average error, different operational consequences

In an invented two-day planning example, actual demand is 100 units on each day. Model A predicts 80 and 120; model B predicts 100 and 140. Both have a mean absolute error of 20 units.

Suppose, solely for illustration, an unmet unit of demand has a planning penalty of five points and an excess unit has a penalty of one point. Model A incurs 20 x 5 plus 20 x 1 = 120 points. Model B incurs 40 x 1 = 40 points.

The equal average-error metric hides different consequences under this stated decision rule. The penalties are invented and would require justification in a real project. The example shows why model risk assessment needs the use and its error costs, not just a generic accuracy comparison.

Illustrative case study

Fictional company Cedar Inventory validates a demand model on ordinary weeks and uses it for staff recommendations. Later, a team connects the predictions directly to purchasing without reviewing exceptional events or supplier limits.

A risk review identifies the changed use and the absence of a workable response when inputs become unreliable. The company evaluates relevant scenarios, defines operating limits and gives staff a route to suspend automatic orders. It documents the remaining uncertainty rather than describing the model as universally validated.

The improvement concerns the whole decision process. Retraining the model alone would not have resolved the unsupported expansion in authority.

Common misconceptions and mistakes

Model risk is simply prediction error. Misuse, implementation faults and inappropriate assumptions can also matter.
Validation removes all risk. Evidence supports bounded conclusions and can become outdated.
Every model needs identical review. The process should reflect its use and consequences.
A vendor owns all risk from its model. The deploying organization must still consider how it uses the output.

Business use

Model risk management helps businesses choose where to invest evaluation effort and when to restrict use. It connects technical uncertainty to practical decisions and makes unresolved concerns visible to those accountable for the outcome.

In regulated sectors, teams should consult the guidance that actually applies. For example, U.S. banking agencies issued revised model-risk guidance in April 2026, replacing earlier SR 11-7 guidance. That sector-specific development should not be generalized into a requirement for every AI project. The broader discipline remains to match evidence and controls to the intended use.

Check your understanding

Two models have equal average prediction error. Must they create equal business risk?

Answer: No. Error direction, affected cases, downstream actions and consequences can differ. Evaluate the models within the actual decision process.

Related terms

Model Governance
Model validation
Uncertainty
stress testing
model monitoring
residual risk

Learn next

Read model validation and residual risk. For one model, identify the three most consequential ways its output could be wrong or misused. Connect each to evidence, a response and a responsible owner.

Model validation

Sources

NIST AI RMF Core: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/. U.S. Federal Reserve, SR 26-2, Revised Guidance on Model Risk Management, April 17, 2026: https://www.federalreserve.gov/supervisionreg/srletters/sr2602.htm. The latter is banking supervisory guidance with its own scope; this article is not a compliance assessment. Calculations and scenarios are original illustrations.

Previous: Model Registry Next: Model router