Model Risk
Risk of adverse consequences from incorrect or misused model outputs.
How the laws define this
Regulators and policy frameworks agree that model risk represents the potential for adverse outcomes—such as financial loss or reputational damage—stemming from flaws in model design, data, development, or operational misuse. The primary divergence lies in whether the term focuses broadly on general model outcomes or targets specific artificial intelligence failure modes and mandatory governance procedures. A Blueprint for Greece's AI Transformation restricts its definition to AI models, highlighting technical vulnerabilities like safety failures, poor generalization, and adversarial attacks, while explicitly requiring mitigation through testing, documentation, and governance measures. In contrast, Guideline E-23 from the Office of the Superintendent of Financial Institutions and the Supervisory Guidance on Model Risk Management apply more broadly to generic model errors, incorrect assumptions, and improper application, focusing on business, legal, or operational impacts like suboptimal decisions without specifying required governance actions or limiting the scope strictly to artificial intelligence.
Synthesised from the 3 statutory definitions below. Each one is quoted in full, with its source.
What it triggers
Definitions (3)
The risk of financial, operational, reputational or legal adverse outcomes arising from model design, development, deployment, change, misuse, data issues, or incorrect assumptions and outputs; includes harms from bias, drift, or other model performance degradations.
The set of harms and failure modes that can arise from an AI model’s architecture, training data, evaluation, or operational deployment — including bias, poor generalization, safety failures, adversarial vulnerability, and unintended behaviours — which must be identified, assessed and mitigated through testing, documentation and governance measures.
Model risk is the potential for adverse consequences arising from decisions based on models that are either incorrect or misused. This can result in financial loss, suboptimal business decisions, or reputational damage, stemming from errors within the model or its improper application.
Not to be confused with
Model-intrinsic risk covers only inherent model properties, while model risk includes misuse and external factors like data issues.
Risk management is the process to identify and mitigate model risk, not the risks themselves.
Questions and answers
What does OSFI Guideline E-23 require for model risk?
It addresses enterprise governance for AI systems to address model risks.
How does the US guidance define model risk?
As the potential for adverse consequences from incorrect or misused model outputs leading to financial loss or reputational damage.
What risks does the Greek blueprint cover?
AI harms from architecture, training data, evaluation, or deployment including bias and safety failures.
Related Terms
Model-intrinsic risk
Risk stemming from a model's inherent capabilities or behaviours....
Systemic or correlated risk
Risk from model homogeneity causing market shocks....
Model Risk Management (MRM)
Lifecycle controls for development, validation and use of models....
Risk Management
Systematic process of managing AI-related risks....
Model Documentation
Records of model development, assumptions, and validation....