What is a Model Risk Management?

MRM originated in banking regulation (the Federal Reserve's SR 11-7 guidance) as a framework covering model development, independent validation, and ongoing monitoring, and it has since expanded into a general practice for any organization deploying AI in consequential decisions. Core activities include documenting a model's intended use and limitations, having someone other than the model's builder validate its performance, and setting thresholds that trigger review when live performance drifts from what was validated. For LLM-based systems, model risk extends beyond a single model's accuracy to include prompt injection risk, hallucination in high-stakes outputs, and cascading failures across multi-step agent chains. Effective MRM programs maintain a model inventory, tier models by decision impact, and require higher scrutiny, human review, tighter guardrails, more frequent revalidation, for models used in regulated or high-consequence workflows.