Model Risk Management for AI: What SREP Reviewers Look for in Your Documentation

The SREP examination cycle for AI models follows a structured checklist that has evolved significantly since 2022 to address AI-specific risks that traditional model risk frameworks did not cover. **Phase 1 — Model inventory review:** Reviewers begin by requesting a complete model inventory: every AI/ML model in production, the decisions it influences, the data it processes, when it was last validated, and who is the named accountable owner. Banks that cannot produce a complete inventory fail immediately. AI proliferation (PoC models that were never formally inventoried, vendor models included in credit stacks) is the most common cause of inventory gaps. **Phase 2 — Validation quality assessment:** For each model in the inventory, reviewers examine the most recent validation report. The AI-specific elements they look for: - Out-of-time / out-of-sample test results (not just in-sample performance) - Fairness testing across protected attributes with documented results - Stress testing results under adverse scenarios - Explainability validation (do the XAI outputs make intuitive sense?) - Sensitivity analysis (how does the model behave when key inputs are varied?) **Phase 3 — Ongoing monitoring evidence:** This is where most banks fail. Reviewers want evidence of monitoring *between* validation cycles — typically monthly performance reports showing PSI, MSS, accuracy, and fairness metrics with documented thresholds and any alerts triggered. **Phase 4 — Governance structure:** Reviewers assess whether the bank has a functioning Model Risk Committee, whether AI models go through formal approval processes, and whether there are documented challenge rights for the model validation function.