Model Risk Management
Materiality-Based Model Validation for AI
Not every AI model needs the same validation. The revised interagency guidance ties the depth of review to materiality. Here is how a bank turns that into tiers, tests and sign-off it can defend.
Materiality-based validation means a bank sets the depth of AI model review by how much the model matters. The interagency guidance defines materiality as model exposure together with model purpose. Score both, place each model in a tier, and assign testing, monitoring and sign-off to the tier. Kriv AI helps banks build this, starting with a discovery call.
context
What Materiality Means in Model Validation
The revised interagency guidance on model risk management, issued by the Federal Reserve, the OCC and the FDIC as SR 26-2, treats materiality as the lever that sets how much effort a model deserves. It is the idea that lets a bank spend scarce validation time where an error would cost the most.
Exposure and purpose are the two inputs
The guidance describes model exposure as the significance of the model output to business decisions, which "tends to be greater for models affecting larger portfolios or having a larger business impact." It describes model purpose as a qualitative consideration about the nature and importance of the model. In its words, "Model purpose, together with model exposure, determines model materiality."
Exposure can often be measured, for example by the size of the portfolio the model touches. Purpose is a judgment: the guidance notes that models developed to help meet regulatory requirements or manage financial risk exposures are generally considered greater risk than models not used for those purposes.
Materiality is not the same as complexity
A simple model can be highly material, and a sophisticated one can be minor. The guidance keeps these apart. It describes inherent risk as rising with model complexity, and then says the overall magnitude of model risk reflects inherent risk in the context of materiality. A bank therefore needs two separate views of each model, how hard it is to get right and how much it matters if it is wrong.
ai gap
What the Guidance Says About Depth of Review
The guidance is direct about proportionality. It says banking organizations "may deem certain models immaterial based on model exposure and purpose," and that in those cases model risk management "may consist of identifying those models and monitoring model performance and conditions under which the use of those models may become material." Models of higher materiality "warrant more comprehensive and rigorous oversight."
The same principle runs through the validation section: "The nature and rigor of validation generally align with the model's approach, use, and materiality." Testing follows it too. The rigor of testing is described as commensurate with model complexity and materiality, and monitoring frequency and scope depend on the nature of the model, new data or modeling approaches, and materiality.
Two cautions belong beside this. First, the guidance states that it does not set enforceable standards or prescriptive requirements. It is guidance, and each bank remains responsible for adopting practices suited to its own risks. Second, the guidance says generative AI and agentic AI models are not within its scope, while its principles apply to traditional statistical and quantitative models and non-generative, non-agentic AI models. A bank applying a materiality approach to generative tools is extending the idea by its own policy, and should say so in that policy.
capabilities
Turning Materiality Into Validation Tiers
Score exposure and purpose on a scale you can defend
Write down the scoring criteria before scoring any model. For exposure, record what the model affects: portfolio size, number of customers, dollar outcomes or reporting lines. For purpose, record whether the output supports a regulatory requirement, a financial risk measure, a customer decision or an internal convenience. Keep the scale short, such as three or four levels, so reviewers apply it consistently.
The guidance leaves each bank responsible for building and justifying these criteria itself. Examiners and internal audit may ask how a rating was assigned, so keep the reasoning with the rating, not only the result.
Give each tier a defined validation package
A tier is useful only if it changes what happens. For the highest tier, a package might include independent review of conceptual soundness, testing on data the model has not seen, challenge of assumptions and alternatives, review of data quality and lineage, and a documented effective challenge before approval. For a middle tier, it might be a lighter review with focused testing. For the lowest tier, it might be inventory, an owner, and performance monitoring with a trigger that moves the model up a tier if its use grows.
Set monitoring and revalidation by tier
Ongoing monitoring should follow the same ladder. Higher tiers get tighter performance bands, more frequent reporting and earlier escalation. Lower tiers get a simpler check. Decide in advance what changes force a fresh review, such as a new data source, a retrained model, a vendor update or use in a new business line.
Watch for use beyond the original purpose
The guidance warns that using a model beyond its intended purpose introduces additional uncertainty and risk. Materiality can change without the model changing. A model built for one product that is later reused for another, or one whose portfolio grows, may belong in a higher tier than the one it was given. Put a periodic re-score on the calendar and tie it to change control.
ai gap
Where AI Models Make Tiering Harder
Machine learning models can be hard to explain, can drift as data changes, and can depend on data pipelines that the validator did not build. None of this changes the materiality logic, but it changes the validation package. A highly material model with limited explainability needs stronger outcome testing, clearer monitoring bands and a defined fallback if performance degrades.
Vendor models raise a related issue. The guidance notes that banks may not receive the underlying code, data or methodology of a vendor product, but says the principles of model risk management remain applicable, and that validation of vendor products is an important element. A bank should tier a vendor model on the same exposure and purpose basis as an internal one, then document what it could and could not obtain from the vendor and what extra monitoring covers the gap.
Aggregate risk matters as well. The guidance says risk should be assessed both individually and in aggregate, including reliance on common assumptions, data or methodologies. Several models of moderate materiality that share one data source can together behave like a highly material one. A tiering process should look for shared dependencies, not only score models one at a time.
tiers
A Practical Order of Work
1. 1. Build the inventory
List every model and AI tool in use, including vendor products and models embedded in other systems, with an owner for each.
2. 2. Write the materiality criteria
Define how exposure and purpose are scored, who scores them, and how a rating is challenged and recorded.
3. 3. Tier the inventory
Score each model, review the results for shared data and common assumptions, and assign a tier.
4. 4. Define a validation package per tier
State the testing, documentation, independence and sign-off each tier requires before use.
5. 5. Set monitoring and triggers
Assign monitoring frequency, performance bands and the events that force re-scoring or revalidation.
6. 6. Report to governance
Give the risk committee a current register by tier, with exceptions and overdue reviews visible.
differentiation
How This Differs From Our Related Pages
This page is about the tiering method itself: how to score materiality and what each tier should trigger. Our overview of SR 11-7 and AI covers the guidance in general, our page on model risk management under SR 26-2 covers its scope and what changed, and our page on why bank AI models fail model risk review covers findings after the fact. Our page on AI model risk management for banks covers the program as a whole. Use this page when the question is how to size validation effort across a portfolio of models.
engagement
How an Engagement Works
We begin with a scoping call to understand your model inventory, how materiality is rated today, and which governance bodies already review models. We then agree a defined scope and deliverables, work with your model risk, risk, compliance and technology leaders, and hand over artifacts you own: scoring criteria, a tiering method, a validation package for each tier, monitoring triggers and a register. We do not replace your model risk function, give legal advice, or make regulatory determinations for you.
get a quote
How to Get a Quote
Scope and price depend on the size of the model inventory, the number of vendor models, and how mature your tiering and validation process already are. Book a discovery call and we will scope it with you and price it after that conversation.
Straight answers
Frequently asked questions about Materiality-Based Model Validation for AI
What is materiality-based model validation?
It is an approach where the depth of validation depends on how much a model matters. The interagency guidance defines model materiality as the combination of model exposure and model purpose, and says higher-materiality models warrant more comprehensive and rigorous oversight.
How is model materiality determined?
The guidance names two inputs: exposure, which is the significance of the model output to business decisions and can be measured, for example by portfolio size, and purpose, which is a qualitative view of the nature and importance of the model. Each bank sets and defends its own criteria.
Can a bank treat some AI models as immaterial?
The guidance allows banking organizations to deem certain models immaterial based on exposure and purpose. In that case, risk management may consist of identifying those models and monitoring performance and the conditions under which they might become material. The bank should record the reasoning.
Does the guidance cover generative AI and agentic AI?
No. The guidance states that generative AI and agentic AI models are not within its scope, while its principles apply to traditional statistical and quantitative models and non-generative, non-agentic AI models. Any extension to generative tools is a decision under the bank's own policy.
Is the guidance a legal requirement?
The guidance states that it does not set forth enforceable standards or prescriptive requirements, and that non-compliance with it will not result in supervisory criticism as such. It also notes that supervisory action may follow from violations of law or unsafe or unsound practices stemming from insufficient management of model risk. Ask your counsel how it applies to you.
How often should a model be re-tiered?
The guidance does not set a fixed interval. A sensible policy re-scores a model when its use, portfolio, data, vendor version or business line changes, and on a regular calendar review, because using a model beyond its intended purpose adds uncertainty and risk.
Talk to the team that would do the work
Bring your requirements to a working session with the person who'll actually deliver.
Book a Discovery Call