How to Report AI Risk to the Board of a Bank or Insurer

Current as of October 30, 2026. This guide draws on US interagency model risk guidance (SR 26-2), the UK PRA's supervisory statement SS1/23, Canada's OSFI Guideline E-23, New York's Insurance Circular Letter No. 7, Colorado Regulation 10-1-1, Illinois Company Bulletin 2024-08, the NAIC model bulletin on insurers' use of AI and the NIST AI Risk Management Framework, as published on that date. Which of them apply depends on the firm; it is not legal advice.

Several of the texts reviewed for this guide say who should oversee AI and model risk, and one, the PRA's, says in some detail what the board should receive. None of them prescribes an AI board pack, and none of the texts reviewed sets a quarterly cycle. Responding to public comments, New York's circular letter puts the board's job in a phrase: both senior management and the board have "a responsibility for the overall outcomes of the use of ECDIS and AIS, not the day-to-day implementation."

Unless a step quotes a rule or guidance, it is a recommendation, labeled (interpretation). Companion guides cover the AI inventory, risk tiering, drift monitoring, generative AI under SR 26-2, and explaining individual AI decisions.

On scope: SR 26-2 (April 17, 2026) is interagency guidance that supersedes SR 11-7 and SR 21-8; it says it "does not set forth enforceable standards or prescriptive requirements", while its footnote 1 adds that "supervisory action may result for any violations of law or unsafe or unsound practices stemming from insufficient management of model risk." It is expected to be most relevant to banking organizations above an asset threshold it sets. The PRA's SS1/23 (April 2026 version, in effect since May 17, 2024) applies to UK-incorporated banks, building societies and PRA-designated investment firms with internal model approval for regulatory capital; insurers are not in scope, and it does not mention AI by name. OSFI's Guideline E-23, final since September 11, 2025, applies from May 1, 2027 to all federally regulated financial institutions in Canada, banks and insurers included, and its model definition includes "AI/ML methods". New York's Circular Letter No. 7 (July 11, 2024) sets out the Department's expectations for insurers authorized in the state that use AI systems and external data in underwriting and pricing. Colorado's Regulation 10-1-1, amended effective October 15, 2025, is a binding regulation for the insurers named above. Illinois Company Bulletin 2024-08 (March 13, 2024) sets expectations for all insurers licensed in Illinois. The NIST framework is voluntary.

Step 1: Map the board-level AI expectations that apply to your firm

Keep a one-page map of which texts reach the firm and what each asks of the board (interpretation).

For insurers, check state by state. The NAIC's model bulletin, adopted December 4, 2023, is a template for state regulators: it is addressed to "All Insurers Licensed to Do Business In (Insert Name of Jurisdiction)". It applies in a state only once that state issues it (interpretation). The NAIC's implementation map, status as of April 1, 2026, lists Illinois Company Bulletin 2024-08 among the adoptions, and lists Colorado's and New York's texts separately as insurance-specific regulation or guidance.

Step 2: Name the accountable executive and the board committee

The PRA expects firms to identify a holder of a senior management function (SMF) with overall responsibility for model risk management, who "should be the most senior individual with the responsibility for the risks resulting from models operated by the firm", and to reflect that in the SMF's Statement of Responsibilities. The Illinois bulletin, following the NAIC model, says the AIS program "should vest responsibility for the development, implementation, monitoring, and oversight of the AIS Program and for setting the Insurer's strategy for AI Systems with senior management accountable to the board or an appropriate committee of the board." Colorado requires "Senior management responsibility and accountability for setting and monitoring the overall strategy" for the data and models it covers.

OSFI, consistent with its corporate governance guideline, makes senior management responsible for "ensuring appropriate communication and reporting of model risk to the board of directors." New York allows the board to delegate duties to committees and senior management, and says that when it does, "an insurer should ensure appropriate lines of reporting are in place, along with regular, quality reporting to meet the board's or other governing body's information needs."

Name in the committee charter who receives AI risk reporting and who presents it (interpretation).

Step 3: Have the board set an AI and model risk appetite with measures

The PRA says "The board should set a model risk appetite that articulates the level and types of model risk the firm is willing to accept." It lists the measures the appetite should include, among them "limits on model use, exceptions and overall compliance" and "thresholds for acceptable model performance and tolerance for errors". New York describes the board's role as including oversight to "monitor the insurer's risk appetite." OSFI expects the framework to reflect the institution's risk appetite for model risk and says "In cases where model risk falls outside the institution's risk appetite, the institution should establish appropriate remediation actions."

Write AI into the existing model risk appetite, with a few measurable limits (interpretation), such as the share of highest-tier models with overdue validation, the number of models in use with open high-severity findings, and use outside approved purposes.

Step 4: Build the board report around appetite, tiers and aggregate risk

The PRA names the content: "Reports should include qualitative measures describing: the effectiveness of the control framework and model use; the significant model risks arising either from individual models or in aggregate; significant changes in model performance over time; and the extent of compliance with the MRM framework." New York says reporting "should include all timely and relevant facts for a board or other governing body to understand the material activities and risks associated with the insurer's use of ECDIS and AIS." OSFI expects the framework to define "how an institution provides transparent and consistent reporting of model risk at different levels of the enterprise". SR 26-2 says "Sound practice involves assessing model risk both individually and in aggregate."

A board report that covers those points (interpretation):

• Appetite: each measure from Step 3 against its limit, with breaches first.
• Inventory by tier: counts by risk tier, new and retired since the last report, with generative and agentic AI marked separately at US banks.
• Performance: material changes in the highest-tier models.
• Aggregate risk: shared vendors, data or methods.
• Regulatory outlook: texts that take effect before the next report, such as OSFI E-23 on May 1, 2027.

Step 5: Report exceptions, incidents and remediation, not only status

Among the uses of documentation, SR 26-2 lists "supporting the tracking of recommendations, responses, and exceptions". The PRA lists among the accountable SMF's possible responsibilities "taking prompt remedial action when necessary to ensure the firm's aggregate model risk remains within the board approved risk appetite". OSFI expects monitoring to follow "appropriate escalation procedures". NIST's framework includes "GOVERN 4.3: Organizational practices are in place to enable AI testing, identification of incidents, and information sharing."

Give the board a log of exceptions granted (use before validation or beyond approved scope), AI incidents and complaints, and remediation items with owners and due dates (interpretation). Agree which events reach the committee chair between meetings (interpretation).

Step 6: Prepare the board to challenge the most material models

The PRA says "The board is expected to provide challenge to the outputs of the most material models", and to understand their capabilities and limitations, the boundaries within which performance is expected to be acceptable, the potential impact of poor performance and the mitigants in place should performance deteriorate. Those four headings make a one-page brief for each highest-tier model (interpretation).

NIST's framework names "organizational management, senior leadership, and the Board of Directors" among key AI actors responsible for AI governance. Plan director education accordingly (interpretation).

Step 7: Calendar the annual items the texts name, and set the rest

Where the texts reviewed fix a frequency, it is annual:

• PRA: self-assessments against SS1/23 "should be updated at least annually", with findings and remediation plans shared with boards in a timely manner and "Firms' boards should be updated regularly on remediation progress." A report on the effectiveness of model risk management for financial reporting should be available to the audit committee "on a regular basis, and at least annually."
• New York: the board, a committee or senior management through delegated authority "should review and approve the insurer's ECDIS and AIS-related policies and procedures at least annually".
• Colorado: "Documented comprehensive annual reviews of the governance structure and risk management framework". Annual reports to the Division have been due from life insurers since December 1, 2024, and from private passenger auto and health benefit plan insurers since July 1, 2026. "These reports must be signed by an officer attesting to compliance with this regulation." An insurer that cannot attest must file a corrective action plan.
• Illinois: the bulletin says the state's corporate governance annual disclosure requirements "apply to elements of the Insurer’s corporate governance framework that address the Insurer’s use of AI Systems to support actions and decisions that impact consumers."

Set the regular AI report to the same committee cycle as other principal risks, and put the Colorado officer attestation before the board committee that oversees the framework before it is filed (interpretation).

Step 8: Have internal audit test the reporting itself

New York lists among the matters internal audit may assess "whether there is sufficient reporting to the board or other governing body and senior management to evaluate whether management is operating within the insurer's risk appetite and limits for model risk." The PRA expects internal audit findings on the framework to be "documented and reported to the board and relevant committees on a timely basis." SR 26-2 says that where internal audit is part of a bank's model risk practices, "internal audit's role is generally to evaluate whether the model risk management practices are rigorous and effective and whether related policies are implemented accordingly."

Ask audit to trace sampled board figures to source records (interpretation).

Checklist

Items restate the recommendations above (interpretation).

• A map shows which board-level texts apply, state by state for insurers
• An accountable executive and a receiving board committee are named in writing
• The board-approved model risk appetite covers AI, with measurable limits
• The board report covers appetite, inventory by tier, performance changes and aggregate risk
• Exceptions, incidents and remediation are reported with owners and dates
• Each highest-tier model has a one-page brief for board challenge
• Annual items are calendared, including any Colorado officer attestation
• Internal audit tests whether board reporting is sufficient and accurate

How we sourced this guide: every factual statement in it is drawn from published rules, regulatory guidance and other public documents, and we keep a full set of sources and citations for it. If you would like them, or want to question a point, get in touch through our contact page and we will share them.