# AI Model Risk Management for Financial Institutions > Financial Services · AI Course · FIN-1 > Source: https://ibl.ai/solutions/financial-services/course/ai-model-risk-management > Last updated: 2026-08-25 **Extend model risk governance to generative AI — inventory, validation, challenger testing, and the documentation examiners expect for a non-deterministic model.** ## The Short Answer **Model risk frameworks assume a model you built and can inspect, which a hosted general-purpose LLM is not. ibl.ai lets institutions run models inside their own environment where you own all the code and the data — so validation, version control, and challenger testing operate on an artifact the institution actually controls.** On ibl.ai you own all the code and the data, run it model-agnostic across any LLM, and pay with no per-seat pricing — so you can deploy anywhere, from your own cloud to a fully air-gapped network. [Request Access](https://ibl.ai/contact) · [Explore Financial Services](https://ibl.ai/solutions/financial-services) ## Course facts - **Level:** Advanced - **Duration:** 6.5 hours across 8 modules - **Format:** Cohort workshop producing validation artifacts - **Modules:** 8 - **Catalog code:** FIN-1 - **Frameworks covered:** SR 11-7 model risk guidance, FFIEC, NIST AI RMF, NIST AI 600-1 ## What is this course about? Existing model risk frameworks assume a model you built, can inspect, and can validate deterministically. A general-purpose language model is none of those. This course covers inventory and tiering for a model you did not train, conceptual soundness review under that constraint, monitoring when the vendor updates the model underneath you, and examination-ready documentation. ## Who is this course for? - Model risk management staff - Independent validation teams - Chief risk officers and risk committee members - Internal audit covering model risk ### What do I need before starting? - Model risk management experience - Familiarity with your institution's validation standards ## What will I be able to do afterwards? - Fit generative AI into an existing model risk framework honestly - Inventory and tier AI systems where the model is general-purpose - Conduct conceptual soundness review for a model you did not train - Design monitoring for a model that changes on a vendor's schedule - Produce documentation that survives an examination ## What does each module cover? ### Module 1 — Why doesn't the existing framework fit? The assumptions a traditional model risk framework makes that a general-purpose LLM violates. _(45 min)_ **Objectives** - Identify the framework assumptions generative AI breaks - Decide whether to extend or create a parallel framework - Communicate the gap to the risk committee **Topics:** Framework assumptions · Non-determinism · General-purpose models · Extension versus parallel **Activity:** Map your framework's assumptions against a generative AI use case and find the breaks. ### Module 2 — How do you inventory and tier AI systems? Model inventory when the same underlying model serves many different-risk uses. _(50 min)_ **Objectives** - Define the inventory unit for general-purpose models - Tier by use rather than by model - Capture the attributes validation requires **Topics:** Inventory unit · Use-based tiering · Attribute capture · Shared model complications **Activity:** Inventory and tier five AI uses sharing one underlying model. ### Module 3 — How do you assess conceptual soundness? Soundness review when you did not train the model and cannot inspect its weights. _(55 min)_ **Objectives** - Adapt conceptual soundness review to a third-party model - Assess fitness for the specific use - Document the limits of what you could review **Topics:** Soundness adaptation · Use fitness · Review limits · Honest documentation **Activity:** Conduct a conceptual soundness review for one use and document its limits. ### Module 4 — How do you validate a non-deterministic model? Outcome analysis and benchmarking when the same input can produce different outputs. _(55 min)_ **Objectives** - Design validation for non-deterministic output - Build a representative test set - Set acceptance criteria that mean something **Topics:** Non-deterministic validation · Test set design · Acceptance criteria · Statistical approach **Activity:** Design and run a validation producing defensible acceptance evidence. ### Module 5 — What happens when the vendor updates the model? Ongoing monitoring and the change management problem a hosted model creates. _(50 min)_ **Objectives** - Detect model changes you were not told about - Define what constitutes a material change - Trigger revalidation appropriately **Topics:** Change detection · Materiality · Revalidation triggers · Vendor notification terms **Activity:** Build change detection and define your material change criteria. ### Module 6 — How do you provide effective challenge? Independent validation and effective challenge where the validators may know less than the builders. _(45 min)_ **Objectives** - Structure independent validation for AI systems - Build validator capability - Ensure challenge is genuinely effective **Topics:** Independence · Validator capability · Effective challenge · Escalation **Activity:** Run an effective challenge session on a colleague's AI use case. ### Module 7 — How do you manage third-party model risk? Vendor and fourth-party risk when the model provider sits behind your vendor. _(45 min)_ **Objectives** - Assess vendor and fourth-party model risk - Require adequate transparency contractually - Handle concentration risk across the industry **Topics:** Vendor model risk · Fourth-party risk · Contractual transparency · Concentration **Activity:** Map the model supply chain for one vendor-provided AI capability. ### Module 8 — Building the documentation package The workshop module: an examination-ready package for one AI use case. _(50 min)_ **Objectives** - Assemble the complete documentation package - Anticipate examiner questions - Identify and disclose the gaps **Topics:** Package assembly · Examiner expectations · Gap disclosure · Remediation planning **Activity:** Assemble the package and have a colleague examine it. ## What is the capstone project? **Model risk documentation package for one AI use case.** Produce a complete model risk package: use-based inventory and tiering, conceptual soundness review with documented limits, non-deterministic validation with acceptance evidence, change detection and materiality criteria, and a supply chain assessment. _Deliverable:_ An examination-ready package with gaps disclosed rather than hidden. ## How are learners assessed? - Validation must produce defensible acceptance evidence for non-deterministic output - Soundness review must state honestly what could not be assessed - Package examined by a colleague playing an examiner ## What ships with the course? - **Facilitator guide.** Session-by-session running order, discussion prompts, and the questions that reliably derail a room. - **Learner workbook.** Exercises, checklists, and the templates each module's activity produces. - **Hands-on lab environment.** A sandboxed ibl.ai deployment so exercises run against real agents, not screenshots. - **Assessment bank.** Scenario questions and rubric criteria mapped to each stated learning outcome. - **Source bibliography.** Every primary regulation and standard cited on this page, linked and dated. ## Which AI agents does this course use? - [Risk Assessment Agent](https://ibl.ai/solutions/financial-services/agent/risk-assessment-agent) - [Compliance Agent](https://ibl.ai/solutions/financial-services/agent/compliance-agent) - [Regulatory Reporting Agent](https://ibl.ai/solutions/financial-services/agent/regulatory-reporting-agent) - [Knowledge Agent](https://ibl.ai/solutions/financial-services/agent/knowledge-agent) ## Where does the course material come from? Every module is grounded in primary sources — the regulation, standard, or research itself, not a summary of it. Each was resolved at authoring time. - [Supervision and Regulation Letters](https://www.federalreserve.gov/supervisionreg/srletters/srletters.htm) — Federal Reserve. Index of supervisory guidance including SR 11-7 on model risk management. - [FFIEC](https://www.ffiec.gov/) — Federal Financial Institutions Examination Council. Examination expectations for model and technology risk. - [AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework) — NIST. AI-specific risk structure mapped into the model risk framework. - [NIST AI 600-1, Generative AI Profile](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf) — NIST. Generative-AI-specific risks the validation must address. ## Delivery notes Binding guidance for anyone preparing and delivering this course: - SR 11-7 remains the reference guidance and its deep link has moved; cite the Federal Reserve SR letters index and name SR 11-7 in prose rather than shipping a URL that will 404 again. - Module 3 must be honest that conceptual soundness review of a third-party model is severely limited. Documenting the limits is the deliverable; pretending to a full review is worse than admitting the gap. - Module 4's non-deterministic validation has no settled industry standard. Present the approaches and their trade-offs rather than asserting one is correct. - Have an experienced model validator review the course. Validation practice is set by examination experience, not by framework documents. - Module 5's vendor change problem is the strongest argument for controlling the model. Make the point analytically rather than as a pitch. ## Why run AI training on a platform you own? - **You own the course, not a licence to it.** Course content, learner data, and the platform run inside your perimeter — you own all the code and the data. - **Model-agnostic delivery.** Run the course's AI components on any LLM — Claude, GPT, Llama, Gemini, Command — and switch anytime. - **No per-seat training licences.** Usage-based or self-hosted, so cost tracks actual use rather than headcount. - **Deploy anywhere.** Cloud, private VPC, on-premise, or fully air-gapped — including for cohorts that cannot use public AI tools. ## Frequently asked questions ### What does the AI Model Risk Management for Financial Institutions course cover? Existing model risk frameworks assume a model you built, can inspect, and can validate deterministically. A general-purpose language model is none of those. This course covers inventory and tiering for a model you did not train, conceptual soundness review under that constraint, monitoring when the vendor updates the model underneath you, and examination-ready documentation. It runs 6.5 hours across 8 modules across 8 modules, at advanced level, and closes with a capstone: Model risk documentation package for one AI use case. ### Who should take AI Model Risk Management for Financial Institutions? It is written for Model risk management staff, Independent validation teams, Chief risk officers and risk committee members, Internal audit covering model risk. Prerequisites: Model risk management experience; Familiarity with your institution's validation standards. ### Can we run this course on our own infrastructure? Yes. ibl.ai is model-agnostic and deploy-anywhere — cloud, private VPC, on-premise, or fully air-gapped — and you own all the code and the data. Cohort data, submissions, and any material learners upload stay inside your perimeter, which matters for financial services teams that cannot send work to a public AI tool. ### How do we get access to AI Model Risk Management for Financial Institutions? Request access and we will set it up for your cohort — hosted by ibl.ai, or running against your own deployment. Tell us the group size and timing you need, and whether it should run inside your own perimeter. ### How much does AI training for financial services cost on ibl.ai? There is no per-seat pricing — you pay for usage or self-host and pay only for the infrastructure, so a 5,000-person rollout does not cost 5,000 licences. 1.6M+ users across 400+ organizations run the platform this way, including NVIDIA, MIT, and Syracuse University. ## More Financial Services courses - [KYC and AML with AI: Screening, Alerts, and SAR Support](https://ibl.ai/solutions/financial-services/course/kyc-aml-with-ai): Apply AI across the BSA/AML program — name screening, alert triage, and narrative drafting — without weakening the audit trail a regulator will examine. - [AI Supervision Under FINRA and SEC Recordkeeping Rules](https://ibl.ai/solutions/financial-services/course/ai-supervision-finra-sec): Supervise AI in a broker-dealer or RIA — communications review, books and records obligations, and what happens when an agent talks to a client. - [Fraud Detection with AI: Anomalies, Alerts, and False Positives](https://ibl.ai/solutions/financial-services/course/fraud-detection-with-ai): Build AI-assisted fraud detection where a false positive is a blocked customer — anomaly detection, adaptive fraud, and fair-lending exposure. - [AI for Client Advisory Without the Compliance Risk](https://ibl.ai/solutions/financial-services/course/ai-client-advisory-compliance): Research and client content generation inside a regulated advisory business — sourcing, review workflow, disclosure, and the line before personalized advice. - [Regulatory Reporting Automation: SOX, PCI DSS, and Audit Trails](https://ibl.ai/solutions/financial-services/course/regulatory-reporting-automation): Automate regulatory reporting and control testing with AI — evidence collection, narrative drafting, and a control environment that keeps the automation auditable. - [Private LLMs in Finance: Keeping Client Data In-House](https://ibl.ai/solutions/financial-services/course/private-llms-in-finance): Deploy capable models inside your own network — open-weight selection, hardware sizing, GLBA and cross-border considerations, and the ownership question.