SR 11-7 Model Risk Management Compliance 2026

Why SR 11-7 still matters for AI

SR 11-7 gave banks a practical model risk foundation: keep a complete model inventory, validate models before use, monitor performance, document assumptions and limitations, maintain effective challenge, and report material model risk to governance bodies.

AI has changed the operating environment, but not the need for evidence. A bank using AI-enabled fraud tools, underwriting support, AML alerting, marketing models, customer-service automation, analytics, or vendor-embedded models still needs to show what the model does, who owns it, whether it is appropriate for use, and how it is monitored.

The highest-value first step is a reviewable checklist. It turns model risk language into fields, evidence requests, owners, and due dates that compliance, model risk, vendor management, audit, and leadership can act on.

What the free SR 11-7 AI checklist covers

The checklist is designed for teams that need a fast, practical way to translate SR 11-7 model risk expectations into AI governance evidence. It is especially useful when model risk policies, validation workpapers, audit programs, and board materials still use SR 11-7 language.

Use it to identify missing inventory fields, stale validation evidence, weak monitoring, unclear ownership, vendor documentation gaps, and reporting needs before an audit, exam, committee meeting, or model-risk review.

• Model and AI system inventory fields
• Ownership, intended use, and limitations
• Risk tiering and customer-impact flags
• Validation, review, and effective-challenge evidence
• Monitoring metrics, thresholds, and change history
• SR 11-7 continuity mapping to current SR 26-2 expectations

How to use the checklist

Start by listing internal models, vendor-provided models, embedded AI features, employee-use AI tools, pilots, and production workflows where outputs influence decisions, controls, reports, or customer outcomes.

Then classify each item by risk and materiality. Credit, fraud, AML, compliance monitoring, regulatory reporting, cybersecurity, customer-impacting, and critical-operations use cases should receive deeper review than low-risk productivity uses.

Finally, convert missing answers into remediation items. A blank owner, stale validation date, missing vendor evidence, undefined monitoring metric, or unreported board issue should become a tracked action with an accountable owner and due date.

SR 11-7 AI checklist preview

Use these questions to screen model risk documentation before a formal validation, audit, exam request, or board-risk update.

1. 1Is every AI-enabled model or model-driven process captured in a centralized inventory?
2. 2Does each model have a named business owner and model risk owner?
3. 3Is the intended use documented, including limitations and prohibited uses?
4. 4Has the model been risk-tiered by materiality, customer impact, complexity, and data sensitivity?
5. 5Is independent validation or proportionate review evidence available before production use?
6. 6Are performance, drift, override, exception, and issue metrics monitored on a defined cadence?
7. 7Are vendor-provided models supported by documentation, testing evidence, and change notifications?
8. 8Are material model changes, retraining events, vendor releases, and threshold changes logged?
9. 9Can audit trace a high-risk model from approval through validation and ongoing monitoring evidence?
10. 10Are legacy SR 11-7 references mapped to current SR 26-2 model risk governance language?

FAQ

Related AI governance resources