SR 11-7 and AI/ML models: what model risk management requires
SR 11-7 is US supervisory guidance (Federal Reserve SR 11-7, and OCC Bulletin 2011-12) on model risk management for banks. It treats a model as any quantitative method that turns inputs into estimates, and expects three things: robust model development and implementation, independent model validation with 'effective challenge', and governance, policies, and controls. AI/ML models used in banking fall squarely within its scope.
What SR 11-7 is
SR 11-7 is guidance issued by the Federal Reserve (mirrored in OCC Bulletin 2011-12) that sets supervisory expectations for how banks manage model risk. It defines a model broadly — a quantitative method, system, or approach that applies statistical, economic, financial, or mathematical techniques to turn inputs into quantitative estimates — which squarely includes machine-learning models.
Model risk is the potential for adverse consequences from decisions based on incorrect or misused model outputs. SR 11-7 asks banks to manage that risk with the same rigor as other risks.
The three pillars
First, robust model development, implementation, and use — sound design, quality data, documentation, and testing. Second, independent model validation that provides 'effective challenge': a critical, competent review by parties with the incentive and standing to question the model, covering conceptual soundness, ongoing monitoring, and outcomes analysis (including benchmarking and back-testing).
Third, governance, policies, and controls — a model inventory, clear roles, and board and senior-management oversight of the whole model lifecycle.
How it applies to AI/ML
AI/ML models raise the bar on the same expectations: explainability and conceptual soundness are harder for complex models, data and feature governance matter more, and ongoing monitoring must catch drift. Validators increasingly need to assess training data, fairness, and stability alongside traditional performance.
Nothing in SR 11-7 exempts AI — a 'black box' does not lower the standard for effective challenge, documentation, or outcomes analysis.
The three pillars of SR 11-7
| Pillar | What it covers | |
|---|---|---|
| Development & implementation | Sound design, quality data, testing, documentation | Build the model right and use it as intended |
| Validation | Independent 'effective challenge': conceptual soundness, monitoring, outcomes analysis | Prove the model works and keeps working |
| Governance | Model inventory, policies, roles, board/senior oversight | Manage model risk as an enterprise discipline |
Frequently asked questions
Does SR 11-7 apply to AI and machine-learning models?
Yes. Its definition of a model is broad enough to include AI/ML, and its expectations for development, independent validation, and governance apply regardless of the modeling technique.
What is 'effective challenge'?
It is critical, independent review by parties with the competence, influence, and incentive to genuinely question a model's assumptions, data, and outputs — not a rubber-stamp validation.
Is SR 11-7 a law?
It is supervisory guidance from US banking regulators, not a statute, but examined banks are expected to meet it and are assessed against it.
This article is general information, not legal or compliance advice. Verify specifics against the current text of each framework and your own counsel.