Bridging the AI governance gap: systematic weaknesses and targeted solutions in financial model risk management

Abstract Financial institutions increasingly deploy artificial intelligence (AI) models for critical decisions, yet traditional Model Risk Management (MRM) frameworks struggle to address AI-specific risks, including opacity, adaptive behaviour, and fairness, conduct, and accountability concerns. Based on a structured review of regulatory guidance, academic literature, and industry commentary, this study identifies twelve recurrent weaknesses in current AI model governance across MRM lifecycle domains, including governance and organisation, scope and model inventory, third-party models, model development and validation, deployment and monitoring, and change management. Key gaps include inadequate stakeholder identification due to the expanded scope of model use beyond traditional risk functions, insufficient AI-specific validation methods requiring hybrid outcome- and process-based approaches, and monitoring frameworks that are insufficiently adapted to dynamic AI models. We propose targeted governance enhancements aligned with emerging regulatory frameworks and supervisory guidance, including the EU AI Act, the European Central Bank’s Guide to internal models, and the United Kingdom Prudential Regulation Authority’s Supervisory Statement SS1/23. These enhancements include clarifying model definitions, incorporating AI-specific tiering criteria, and establishing vendor governance protocols. Three case illustrations demonstrate context-sensitive application across market risk modelling, enterprise chatbot deployment, and strategic AI use-case discovery. These findings bridge the gap between high-level regulatory principles and lifecycle-level MRM implementation, offering financial institutions a structured basis for strengthening AI-related MRM while maintaining regulatory compliance and operational resilience.