Top risks and controls for Artificial Intelligence and Model Risk

From the Doorstep International risk register, curated by Ahmer Nehal. Last updated 17 Oct 2026.

The Artificial Intelligence and Model Risk register lists 24 key risks and 72 best-practice controls across 6 units: Agentic AI and Automation, AI Governance and Oversight, AI Model Validation and Monitoring, AI Use-Case Inventory and Materiality, Generative AI Applications, Third-Party AI and Data. Use it to identify risks, benchmark your existing controls or start a risk and control self-assessment (RCSA).

Get the RCSA workbook Run it in the software

Banks, insurers, brokerages and fintechs now run artificial intelligence inside credit decisions, fraud and AML monitoring, customer service, software development and back-office operations. Each use carries model risk (wrong outputs), operational and cyber risk (failure, misuse, attack), conduct and compliance risk (unfair or unexplainable outcomes) and third-party risk (dependence on a few AI providers).

This function lists the key risks and best-practice controls for governing AI across its life cycle: inventory and materiality, development and selection, validation, human oversight, monitoring, change and retirement. The controls reflect the Federal Reserve, OCC and FDIC revised model risk guidance (SR 26-2, April 2026), the FSB Sound Practices for Responsible Adoption of AI (October 2026), the MAS Guidelines on AI Risk Management (October 2026) and the NIST AI Risk Management Framework.

Agentic AI and Automation: key risks and controls

Covers AI agents that plan and carry out multi-step tasks, call tools and act in systems on the institution's behalf, where errors can be executed before a human sees them.

Risk	What can go wrong	Best-practice controls
Accountability gap for autonomous decisions	Decisions taken by an agent cannot be explained to customers, auditors or regulators.	Use cases that affect customers or financial reporting record the basis of each decision in a reviewable form. A named human owner reviews agent performance and exceptions at a set frequency. Agentic use cases are rated high materiality until evidence supports a lower rating.
Agent acts outside its intended authority	An agent executes payments, changes records or sends communications beyond what was intended, because its permissions or instructions are too broad.	Each agent has a defined mandate, an allow-list of tools and transaction limits enforced by the system, not by the prompt. Actions above set thresholds, irreversible actions and customer-impacting actions require human approval. Agents run under their own service identities with least-privilege access, never a staff member's credentials.
Cascading errors across connected agents	One agent's wrong output is consumed by other agents or systems, multiplying the impact before detection.	Hand-offs between agents and systems include validation checks on format, limits and reasonableness. Monitoring alerts on unusual volumes, values or error rates in agent-driven processes. Scenario tests of agent failures are included in operational resilience testing.
No ability to stop or roll back an agent	A malfunctioning agent cannot be halted quickly, or its actions cannot be traced and reversed.	A tested kill switch allows the business owner and operations to suspend any agent immediately. Every agent action is logged with inputs, reasoning trace where available, tool calls and outcomes. Fallback manual procedures exist and are tested so that the process continues when the agent is switched off.

AI Governance and Oversight: key risks and controls

Sets the board-approved approach to AI: risk appetite, accountability, policies and reporting, so that AI adoption matches the institution's strategy and the board can see where AI is used and what could go wrong.

Risk	What can go wrong	Best-practice controls
AI policy not aligned with existing risk frameworks	AI rules sit in a stand-alone policy that does not connect to model risk, operational risk, information security, outsourcing and conduct policies, leaving gaps and contradictions.	The AI policy maps each AI risk to the existing framework that manages it (model, operational, cyber, third-party, conduct, data protection). The model risk policy states which AI systems fall under model validation and which are governed by the AI policy instead, including generative and agentic AI. Policies are reviewed at least annually and whenever a regulator issues new AI guidance.
Insufficient AI skills in oversight functions	Risk, compliance and audit staff lack the knowledge to challenge AI developers and vendors, so oversight becomes a formality.	Role-based AI risk training for board members, senior management, risk, compliance and audit, refreshed annually. Independent challenge of material AI use cases is performed by staff or advisers with demonstrated AI and model expertise. Internal audit includes AI governance in its annual risk-based audit plan.
No board-approved AI risk appetite	AI use grows business line by business line without an agreed limit on where AI may be used, how much reliance is acceptable or which outcomes are unacceptable, so senior management cannot tell when AI risk is out of bounds.	Board approves an AI risk appetite statement with measurable limits, for example the number of high-materiality AI use cases and the share of material use cases dependent on one provider. AI risk is reported to the board risk committee at least quarterly against the appetite, with breaches escalated. Material new AI use cases require sign-off from the CRO or a delegated AI risk committee before deployment.
Unclear ownership of AI outcomes	Nobody is clearly accountable when an AI system makes or supports a wrong decision, because ownership is split between the business, technology, data science and the vendor.	Each AI use case has a named business owner accountable for its outcomes, recorded in the AI inventory. A RACI defines the roles of business owners, developers, independent validators, compliance, information security and internal audit across the AI life cycle. Accountability for AI use is written into senior managers' role profiles and performance objectives.

AI Model Validation and Monitoring: key risks and controls

Provides effective challenge of AI models before and after deployment: conceptual soundness, outcomes analysis, bias and stability testing, and ongoing performance monitoring.

Risk	What can go wrong	Best-practice controls
Model drift and performance decay	Changes in customers, products, fraud patterns or data cause model accuracy to fall without anyone noticing.	Each material model has defined performance thresholds and a monitoring report at a set frequency. Breaches of thresholds trigger documented actions: overlay, recalibration, redevelopment or withdrawal. Data drift on key inputs is tracked automatically and reviewed by the model owner.
Unexplainable model decisions	The institution cannot explain why a model reached a decision, so it cannot justify outcomes to customers or supervisors.	Explainability requirements are set by use case, with simpler models preferred where performance is comparable. Where explainability is limited, compensating controls such as human review, tighter limits and enhanced monitoring are documented. Customer-facing decisions can be accompanied by the main reasons in plain language.
Unfair or biased outcomes	Model outputs disadvantage groups of customers, creating conduct, legal and reputational risk.	Fairness metrics are defined for customer-impacting models and tested before launch and periodically. Use of protected characteristics and close proxies is reviewed and justified or removed. Adverse outcomes and complaints are analysed for patterns linked to model decisions.
Validation not proportionate to materiality	High-materiality AI models receive the same light review as low-risk tools, or validation is skipped because of urgency.	Validation depth and frequency are set by materiality tier, consistent with SR 26-2's risk-based approach. Models used before validation is complete carry documented use limits, extra monitoring and stakeholder notification. Validators are independent of developers and have the standing to require changes.

AI Use-Case Inventory and Materiality: key risks and controls

Identifies every place AI is used, including AI embedded in vendor products and tools used by staff, and rates each use case so that controls are proportionate to its risk.

Risk	What can go wrong	Best-practice controls
AI used beyond its approved purpose	A model or tool approved for one task is reused for another, without analysis of whether it is fit for the new purpose.	Approval records state the permitted use, users and limitations of each AI use case. Any extension of use is treated as a change requiring a fresh materiality assessment and, if material, validation. Periodic attestation by business owners confirms that AI is used only as approved.
Incomplete AI inventory	AI embedded in purchased software, cloud services and productivity tools is missing from the inventory, so it receives no review, monitoring or contingency planning.	A single AI and model inventory records owner, purpose, data used, provider, materiality rating, validation status and monitoring results for each use case. Procurement, IT change and new-product processes include a mandatory question on whether the product or change uses AI. The inventory is reconciled at least twice a year against software licences, vendor contracts and network traffic to AI services.
Materiality under-rated	A use case is rated low risk although it influences credit, pricing, customer treatment or financial reporting, so it escapes validation and monitoring.	A documented materiality method scores each use case on impact, exposure, purpose, complexity and degree of reliance or autonomy. Use cases affecting customers, regulatory reporting or financial risk are rated at least medium materiality by default. Ratings are reviewed when the use, data, model or provider changes, and at least annually.
Shadow AI use by staff	Employees use public AI tools for work without approval, exposing customer data and producing unreviewed outputs.	An acceptable-use standard lists approved AI tools and prohibits entering customer, confidential or personal data into unapproved tools. Web filtering and data loss prevention rules block or monitor uploads to unapproved AI services. Approved enterprise AI tools are made available so that staff have a safe alternative.

Generative AI Applications: key risks and controls

Covers chatbots, document drafting, summarisation, coding assistants and other systems built on large language models, which can produce fluent but wrong or unsafe outputs.

Risk	What can go wrong	Best-practice controls
Hallucinated or inaccurate outputs	The model produces confident but false statements, figures or references that staff or customers rely on.	Outputs used in decisions or customer communications are reviewed by a competent person before use, with the reviewer recorded. Retrieval from approved internal sources is used for factual answers, and answers cite the source document. Accuracy is tested on a representative question set before launch and sampled monthly in production.
Leakage of confidential or personal data	Customer or confidential information is exposed through prompts, outputs, logs or provider retention.	Contracts with the AI provider prohibit training on the institution's data and specify retention and deletion. Personal and confidential data is masked or excluded from prompts unless the use case is approved for it. Prompt and response logs are access-controlled, retained per policy and monitored for sensitive data.
Misleading or non-compliant customer communication	A customer-facing assistant gives advice, promises or product information that breaches conduct rules or disclosure requirements.	Customers are told when they are interacting with AI and can reach a human. Approved scripts and guardrails restrict the assistant to permitted topics and products. Compliance reviews a sample of conversations each month and complaints are tagged when AI was involved.
Prompt injection and jailbreaks	Instructions hidden in emails, documents or web pages manipulate the model into revealing data, ignoring rules or taking unintended actions.	Input filtering and output screening are applied to every request and response, with blocked attempts logged. The model has no direct access to systems or data beyond what the use case strictly needs (least privilege). Red-team testing for prompt injection is performed before launch and after significant changes.

Third-Party AI and Data: key risks and controls

Manages dependence on external AI model providers, cloud platforms and data suppliers, which concentrate risk in a small number of firms.

Risk	What can go wrong	Best-practice controls
Concentration on a few AI providers	Many processes depend on the same foundation model or cloud provider, so one outage or change affects the whole institution.	Dependencies on each AI provider are mapped across use cases and reported against risk appetite. Exit and substitution plans exist for material AI services and are tested. Critical services have fallback processes that do not depend on the same provider.
Poor quality or unlawfully sourced data	Training or input data is inaccurate, incomplete, unrepresentative or used without a lawful basis.	Data used for AI has a documented owner, source, lineage, quality checks and lawful basis. Data quality metrics on key inputs are monitored and breaches block use until resolved. Data supplier contracts include quality warranties, permitted-use terms and audit rights.
Unannounced changes to provider models	The provider updates or retires a model version, changing outputs without warning.	Model versions are pinned where possible and provider change notices are monitored. Regression tests run on a standard test set whenever the provider version changes. Contracts require advance notice of material changes and version deprecation.
Vendor model treated as a black box	The institution relies on a vendor's AI model without understanding its design, data, limitations or performance.	Due diligence obtains model documentation, testing evidence and limitations from the vendor before contract. Vendor models are validated and monitored like internal models, using outcomes analysis where code is not available. Contracts give rights to information, audit and notification of material model changes.

This register is a starting point for risk identification and benchmarking against international practice. Adapt the risks and controls to your institution's size, products, jurisdiction and regulatory requirements.

Get the Artificial Intelligence and Model Risk register as an RCSA workbook

A spreadsheet-ready CSV with every risk and control on this page, plus blank columns for control owner, inherent likelihood and impact, control design, operating effectiveness, residual rating and actions. We confirm your email with a 6-digit code, then email you the download link.

Frequently asked questions

What are the key risks in Artificial Intelligence and Model Risk?

The main risk areas covered are Agentic AI and Automation, AI Governance and Oversight, AI Model Validation and Monitoring, AI Use-Case Inventory and Materiality, Generative AI Applications, Third-Party AI and Data. Each unit lists its key risks with a short explanation and the best-practice controls that mitigate them.

How do I use this register for a risk and control self-assessment?

Select the risks that apply to your units, map the listed controls to the controls you actually operate, rate inherent risk and control effectiveness, then agree actions for gaps. The free RCSA workbook on this page has the columns ready.

Put these controls to work this month

Start on the cloud risk management software within 24 hours, or ask for training or advice tailored to your institution.

Request a software demo Ask a question