Model risk management

Model risk management is how an institution keeps track of the models it relies on: who owns each one, what it may be used for, what evidence supports it, who validated it, when it was approved, how it is monitored, and what happens when it stops working.

What it covers

An inventory with an owner per model. A stated intended purpose and the boundary outside which the model must not be used. Development evidence — data lineage, method choice, calibration, testing, limitations. Independent review, where the institution has that function. An approval record. Ongoing monitoring with thresholds. A change and retirement process.

Why agentic systems raise the stakes

A model that produces a number for a human to read fails visibly. A model whose output feeds an automated action can fail quietly and at volume. That is why authority, thresholds, approved tool scope, and stop conditions live outside the model as separate controls, and why the evidence record covers the whole path from input to action rather than the model alone.

What eqlx does and does not do

eqlx builds the technical system, produces the evidence, and designs the monitoring and change path around it. Independent model validation is an institutional function held by the institution; describing a system's evidence is not the same as validating it: eqlx prepares the evidence, and independent validation stays with the institution's own validation function.

See Machine-learning models for the engineering lifecycle and the application scorecard use case, which stops at independent validation and policy authority.

Primary references and applicability

• PRA Supervisory Statement SS1/23 — Model risk management principles for banks — the current UK statement is scoped to the firms identified by the PRA and has an effective version dated 23 April 2026.
• OCC Bulletin 2026-13 — Model Risk Management: Revised Guidance — revised US interagency quantitative-model guidance; the bulletin states its own institutional, asset-size, legal-effect, and model-type boundaries, including that generative and agentic AI are outside its scope.
• EBA Guidelines on PD and LGD estimation and treatment of defaulted exposures — an applicable EU source for the specific IRB risk-parameter models it covers, not a universal MRM rule.

These sources are jurisdiction-, institution-, model-, and use-specific. The institution's legal, compliance, risk, and model-governance owners decide which requirements and supervisory expectations apply. This glossary is not legal advice, a compliance determination, or independent validation.