Model Risk Management (MRM) — AI Glossary

Reference details

Related terms

• AI Audit
• NIST AI Risk Management Framework
• Responsible AI

How it works

1. Every model in scope is entered in an inventory with an owner, a purpose, and a tier set by the consequence of it being wrong. Nothing can be governed that is not on the list.
2. Validation is performed by someone independent of the developer and examines assumptions, data, limitations and alternatives — not only whether the accuracy number is good.
3. Each model gets documented limits: the inputs it is valid for, and what must happen when it is used outside them.
4. Monitoring runs continuously against those limits, watching for performance drift and input-distribution shift rather than waiting for an incident.
5. Findings and overrides are logged, and the tier sets the revalidation cycle, so the control is periodic rather than one-off.

Example: Why tiering is the load-bearing step

An institution inventories 300 models. Validating every one annually at two reviewer-weeks each is 600 reviewer-weeks — about twelve reviewer-years, which no team has. Tiered, perhaps 30 are consequential enough for annual independent validation (60 weeks), the next 100 go to a three-year cycle (roughly 67 weeks a year), and the remainder get monitoring with validation on change. The arithmetic is why tiering exists: without it the framework is either unaffordable or applied in name only.

Commonly confused with

Read as a synonym for AI governance, which inverts the lineage. MRM is a specific supervisory discipline from financial services, built for statistical models and extended to AI — its vocabulary is inventory, validation, tiering and revalidation. AI governance is the broader and younger field covering fairness, transparency and societal impact. An organisation with mature MRM already has the inventory and validation machinery AI governance needs, and typically lacks the fairness and explainability components; one with an AI ethics policy and no inventory has the opposite gap.

When to use it

Reach for it when:

• A regulated institution is bringing model-driven decisions under an existing supervisory framework.
• You need independent validation and revalidation cycles rather than a one-off review.
• Explaining why model documentation must state the conditions under which a model is valid.

Reach for something else when:

• Describing fairness, transparency or societal-impact work, which MRM was not built to cover.
• A small deployment where the inventory and validation overhead exceeds the risk being managed.

Continue your research

Use these connected ModelRefs sections to compare alternatives, inspect implementation paths, and review the evidence and governance boundaries relevant to Model Risk Management (MRM) — AI Glossary.

• Browse models
• Review providers
• Inspect benchmarks
• Explore workflows
• Learn AI concepts
• Read decision guides
• Review trust and methodology
• Start a decision path