AI Use in Regulatory Reporting and Risk Modeling
Map all AI system use cases in regulatory reporting, stress testing, and risk modeling to supervisory expectations, and document how AI outputs are validated before submission to regulators.
Objective
Ensure AI systems used in regulatory reporting or risk modeling are identified, mapped to applicable supervisory expectations, and subject to validation controls that meet or exceed examiner requirements.
Maturity Levels
Initial
AI use in regulatory reporting is not systematically tracked. AI tools are used opportunistically without formal validation.
Developing
Major AI uses in reporting are known informally, but a complete inventory has not been documented and supervisory expectations have not been reviewed.
Defined
A register maps every AI system used in regulatory reporting or risk modeling to applicable supervisory guidance. Validation documentation exists for each system.
Managed
AI use in regulatory reporting is reviewed annually by Model Risk Management and internal audit. Validation findings are tracked to remediation. Regulators have been proactively notified of material AI uses where required.
Optimizing
AI validation methodology is benchmarked against leading-practice supervisory guidance (SR 11-7, ECB model risk guidance, MAS FEAT). Engagement with examiners includes advance discussion of AI model governance approaches.
Evidence Requirements
What an auditor or assessor would expect to see for this control.
- —AI use in regulatory reporting register listing every system, its regulatory application, applicable supervisory guidance, validation status, and last validation date.
- —Validation documentation meeting applicable supervisory standard (SR 11-7, ECB, or equivalent) for each AI model in scope.
- —Evidence of regulatory notification or disclosure where material AI use in reporting has been introduced or materially changed.
Implementation Notes
Key steps
-
Inventory all AI uses in regulatory-facing processes:
- Credit risk models (stress tests, DFAST/CCAR scenarios, IFRS 9/CECL calculations)
- AML/transaction monitoring models
- Fraud detection
- Capital modeling
- Regulatory reporting (automated data extraction, report generation, reconciliation)
- Insurance actuarial modeling
- Investment risk analytics
-
For each identified use, document: model description, use in regulatory context, applicable supervisory guidance, validation approach, and last validation date.
-
Map each use to applicable supervisory expectations:
- US banks: SR 11-7 model risk management guidance applies to all models including AI/ML.
- EU banks: ECB Guide on internal models; EBA Guidelines on internal governance.
- Singapore: MAS FEAT Principles for AI in financial services.
- Insurance: State insurance commissioner AI model expectations (varies by state).
- AML: FATF AI guidance; FinCEN expectations on AI in suspicious activity monitoring.
-
Validate AI models used in regulatory reporting to the applicable standard. For SR 11-7: conceptual soundness review, outcome analysis, benchmarking, sensitivity analysis.
-
Notify regulators proactively where material AI use changes occur in regulatory-facing models. Some supervisors require advance notice before live deployment.
Common gaps
- Treating AI in regulatory reporting as outside the scope of model risk management because it is used for report generation rather than directly in decisions.
- Not extending SR 11-7 governance to machine learning models added to existing reporting pipelines.
- Using vendor-supplied AI models in regulatory reporting without obtaining model documentation from the vendor.
Example Implementation
AI Use in Regulatory Reporting Register (excerpt)
| System | Regulatory Use | Supervisory Standard | Validation Standard | Last Validated | Examiner Notified | Status |
|---|---|---|---|---|---|---|
| ML credit loss model | CECL expected loss estimation (10-K disclosure) | SR 11-7 + FASB ASC 326 | SR 11-7 full validation | 2025-09 | Yes — OCC 2025-10 | Live |
| AML transaction monitoring AI | SAR filing trigger | SR 11-7 + FinCEN guidance | SR 11-7 conceptual soundness + outcome analysis | 2025-11 | Yes — FinCEN advisory | Live |
| Report generation LLM | Automated MD&A drafting (human reviews) | FTC + SEC guidance | Output accuracy review + human sign-off log | Monthly | No — not material change | Live — enhanced review |
| Stress test scenario AI | DFAST adverse scenario generation (input to approved model) | SR 11-7 | Benchmarking against historical scenarios | 2025-06 | Yes — Fed 2025-07 | Live |