Risk Management of Artificial Intelligence Models in Banks: A Risk-Based Approval Mechanism

Abstract

The article develops a risk-based approach to managing the risks associated with artificial intelligence models in banks, with a focus on ensuring their safe and controlled use in financially material decision-making. The methodological framework of the study combines structural-functional decomposition, matrix mapping, and normative-conceptual modelling. It is argued that the intensity of model controls should be determined not by the technological complexity of the algorithm, but by the functional materiality of the use case and the magnitude of potential financial, prudential, operational, and customer-related consequences of model failure. A four-level M1–M4 materiality classification is proposed, under which the model class is assigned according to the maximum level of potential impact, while critical use cases are automatically subject to the highest level of control. A seven-stage model lifecycle is developed, covering initiation, data preparation, development, independent validation, approval and deployment, monitoring, as well as model modification, suspension, or retirement. The core element of the approach is a non-compensatory PASS/CHECK/STOP rule, under which a critical deficiency in data, validation, explainability, human oversight, third-party controls, or operational resilience cannot be offset by strong predictive performance or the economic benefits generated by the model. A RACI-based allocation of responsibilities is proposed to distinguish the roles of the business owner, model developer, independent validation function, risk management, IT/cyber function, internal audit, and the model approval body. The scientific novelty lies in integrating functional materiality, the model lifecycle, a non-compensatory admission mechanism, and personalized accountability into a unified artificial intelligence model risk management framework. The practical significance of the proposed approach lies in its applicability by banks and supervisory authorities to determine the intensity of controls, establish model approval conditions, organize monitoring and revalidation, and define human override, rollback, and exit procedures.