Key Takeaways
- ›US bank model risk guidance changed on April 17, 2026: SR 26-2 replaced SR 11-7, states that non-compliance alone will not result in supervisory criticism, and puts generative and agentic AI outside its scope. How a bank governs those systems now rests on its own framework.
- ›Products sold under the AI governance label fall into two groups: model risk platforms built around inventory, independent validation and monitoring, and AI governance platforms built around use-case intake, policy and controls. Decide which gap you are filling before comparing vendors.
- ›Insurers face more specific expectations than banks: New York's Circular Letter No. 7 and Colorado's Regulation 10-1-1, now extended to private passenger auto and health insurers, call for inventories, drift monitoring and testing for unfair discrimination.
- ›Large platform vendors come to this purchase from different starting points: IBM from governance, risk and compliance, SAS from bank model risk and analytics, ServiceNow from IT workflow, OneTrust from privacy and Collibra from data governance. Specialist vendors that focus on model risk or AI governance alone are listed by name in the guide.
- ›Every bank and insurance supervisory text reviewed keeps vendor and third-party models the institution's responsibility, so ask each vendor to show how its platform records, tests and monitors a model you did not build.
- ›Dates outside the US are now fixed: the EU AI Act's high-risk obligations for credit scoring and life and health insurance pricing apply from December 2, 2027, and Canada's OSFI Guideline E-23, which includes AI in its definition of a model, takes effect May 1, 2027.
AI Governance and Model Risk Platforms: Vendors Compared
6 platforms, assessed against the criteria in this guide. The positions are our opinion — here is how we evaluate.
| Vendor | Position | Best for |
|---|---|---|
| IBM watsonx.governance | AI governance platform | Large institutions standardizing AI governance alongside an IBM GRC estate |
| SAS Model Risk Management | Model risk platform | Banks already running SAS for risk, capital and credit models |
| ServiceNow Super Intelligence Control Tower | AI governance platform | Institutions that run technology risk and IT workflows on ServiceNow |
| OneTrust AI Governance | AI governance platform | Institutions already running OneTrust for privacy |
| Collibra AI Command Center | AI governance platform | Institutions already governing data in Collibra |
| Moody's model risk management solutions | Credit model risk | Banks managing credit risk models, especially those using Moody's models |
AI Governance and Model Risk Platforms: Executive Summary
The rulebook for bank model risk was rewritten in April 2026, and it leaves generative AI and agents to each bank's own judgment. That gap is what these platforms are bought to fill.
For fifteen years, US banks organized model risk around SR 11-7, the Federal Reserve and OCC guidance of April 2011. On April 17, 2026 the Federal Reserve, the OCC and the FDIC replaced it with revised guidance (SR 26-2 at the Federal Reserve, FIL-15-2026 at the FDIC). The revised guidance keeps the familiar elements of inventory, validation, effective challenge, monitoring and documentation, but it is expressly non-binding, it is aimed at larger banking organizations, and it states that "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance."
That leaves a bank deploying generative AI or agents with no supervisory template for them, and an instruction to let its own "risk management and governance practices" decide. Insurers are in a different position: state regulators in New York and Colorado have written specific expectations for inventories, drift monitoring and testing for unfair discrimination. In the EU and Canada, the dates are now set.
This guide covers the software institutions buy to meet those expectations: model risk management platforms extending into AI, enterprise AI governance platforms, and the monitoring and testing tools that sit beside them. It profiles six large, established platforms from their own published materials, lists thirteen specialist vendors by name, sets out the regulatory drivers, and gives the questions that separate a platform that can govern a credit model from one that can also govern an agent.
Regulatory Drivers for AI Governance and Model Risk Platforms
Most institutions do not buy an AI governance or model risk platform because the technology is interesting. They buy one because a supervisor, an examiner or a board expects evidence: a complete inventory, independent review, monitoring that is actually done, and a record that survives staff turnover. What that evidence has to show depends on where an institution operates and what it sells, and in 2026 several of the underlying rules changed at once.
US banks. The April 2026 interagency guidance kept the core of model risk management (inventory, validation, effective challenge, monitoring and documentation) but made it non-binding, aimed it mainly at larger banking organizations, and placed generative and agentic AI outside its scope. Banks still need a defensible approach to those systems; they now have to write it themselves.
US insurers. State regulators have been more specific. New York's Circular Letter No. 7 and Colorado's Regulation 10-1-1 expect inventories, drift monitoring and testing for unfair discrimination, and Colorado now applies its regulation to private passenger auto and health insurers as well as life insurers. Many states have issued AI bulletins for insurers; Illinois is one example, and New York says its circular letter includes a clause drawn from the NAIC's Model Bulletin.
Outside the US. The EU AI Act treats credit scoring of individuals and life and health insurance pricing as high-risk, with obligations that now apply from December 2027. The UK's PRA sets model risk principles for banks with internal model approval, and Canada's OSFI Guideline E-23, which covers AI and machine learning models, takes effect in May 2027.
The table below summarizes each instrument's status as of October 29, 2026, read from the issuing body's own documents, and what it expects a platform to help evidence.
| Instrument | Who it applies to | Status | What it expects you to evidence |
|---|---|---|---|
| Revised Guidance on Model Risk Management: SR 26-2 (Federal Reserve), FIL-15-2026 (FDIC), with the OCC | US banking organizations; the FDIC says it is expected to be most relevant to those above a total-asset threshold set in the guidance, and it may also be relevant to smaller banks with significant model risk | Issued April 17, 2026. Replaces SR 11-7 and SR 21-8. Non-binding. Generative and agentic AI are out of scope | Model inventory, validation with effective challenge, ongoing monitoring, documentation, validation and monitoring of vendor models |
| New York DFS Insurance Circular Letter No. 7 (2024) | Insurers authorized to write insurance in New York | Issued July 11, 2024 | Inventory of AI systems in use, in development and recently retired; at least annual testing including drift; unfair-discrimination testing before production and on material change; a documented search for less discriminatory alternatives |
| Colorado Regulation 10-1-1 (under SB21-169) | Life, private passenger auto and health benefit plan insurers in Colorado | Amended effective October 15, 2025; auto and health insurers' frameworks must be available on request from July 1, 2026 | Board or committee oversight, an inventory with version control, quantitative testing for unfair discrimination, drift monitoring, annual review and officer attestation |
| Illinois Department of Insurance Company Bulletin 2024-08 | Insurers and regulated entities licensed in Illinois | Issued March 13, 2024 | A written AI program covering the full life cycle, inventories of predictive models, drift assessment, and, where appropriate and available, contract terms giving audit rights or access to audit reports |
| EU AI Act, Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744 | Providers and deployers of AI for creditworthiness of individuals and for life and health insurance risk assessment and pricing | In force; high-risk obligations for these uses apply from December 2, 2027 | Risk management, logging, human oversight; a fundamental rights impact assessment for deployers in these two uses |
| PRA SS1/23, Model risk management principles for banks (UK) | UK banks, building societies and PRA-designated investment firms with internal model approval | In effect since May 17, 2024; current version April 2026 | Complete model inventory including decommissioned models, a board-approved policy, independent validation, vendor models validated to internal standards |
| OSFI Guideline E-23, Model Risk Management (Canada) | Federally regulated banks and insurers | Final; effective May 1, 2027 | A model definition that includes AI/ML, inventory, independent review, explainability suited to intended use, board reporting |
| NIST AI RMF 1.0 and Generative AI Profile (NIST AI 600-1) | Voluntary, any organization | AI RMF 1.0 is being revised, according to NIST | AI inventory (GOVERN 1.6), third-party AI risk (GOVERN 6.1), fairness and bias evaluation, post-deployment monitoring |
| FINRA Regulatory Notice 24-09 | Broker-dealers | Guidance of June 27, 2024; creates no new requirements | Technology governance, including model risk management, when firms use generative AI |
Three points run through most of the texts in the table. First, an inventory of models and AI systems is expected by the US banking guidance, the PRA, OSFI, New York, Colorado, Illinois and NIST, and several extend it to models under development and retired ones. Second, vendor models remain the institution's responsibility: the US guidance, the PRA, OSFI, New York, Colorado, Illinois and EIOPA all say so in different words, and New York adds that an insurer "may not rely solely on a third-party's claim of non-discrimination". Third, monitoring for drift is named explicitly by Colorado, New York and Illinois and is implied by the ongoing-monitoring expectations of the banking texts.
The Evolution of Model Risk and AI Governance Platforms for Financial Institutions
Model risk platforms grew out of bank model risk management. Their center is the model inventory, risk tiering, an independent validation workflow that keeps validators separate from developers, documentation generated from tests, and monitoring that triggers revalidation. The vendors in this group have added generative AI testing and, in several cases, agent controls.
AI governance platforms grew out of privacy, governance, risk and compliance, and responsible-AI programs. Their center is intake of AI use cases across the enterprise, discovery of AI that nobody registered, policy and control libraries mapped to regulations, approval workflows and, increasingly, runtime controls on agents. Most do not offer a validation workflow of the kind a bank model risk function runs.
Monitoring and testing layers sit beside either kind: observability for drift, explanations and guardrails, or testing services that feed evidence into a system of record. Several vendors in both groups integrate with them rather than replacing them.
How to Evaluate AI Governance and Model Risk Platforms
The weights below are Finantrix's own and reflect a regulated institution governing both traditional models and generative AI. An insurer whose obligations are mainly state AI rules might move weight from validation to fairness testing; a bank governing only traditional models might move it from agent controls to validation.
| Capability Domain | Weight | What to Evaluate |
|---|---|---|
| Inventory and risk tiering | 20% | Coverage of in-house, vendor and embedded AI; discovery of unregistered AI; version history; tiering rules you can configure and audit |
| Validation and effective challenge | 20% | Independent review workflow, separation of developer and validator roles, test libraries, documentation generated from results, tracking of findings |
| Ongoing monitoring | 15% | Drift, performance and data quality monitoring; thresholds that open findings or trigger revalidation; monitoring of vendor models on your own outcomes |
| Generative AI and agent controls | 15% | Evaluation for hallucination, data leakage and prompt injection; agent registration, permissions and action logs; runtime enforcement |
| Fairness and unfair-discrimination testing | 10% | Testing before production and on change, documentation of less discriminatory alternatives, evidence for insurance regulators |
| Regulatory mapping and evidence | 10% | Current mappings (SR 26-2, SS1/23, E-23, EU AI Act, state insurance rules), board reporting, attestation support, examiner-ready exports |
| Deployment and integration | 10% | SaaS, private cloud or on-premises; data residency; integration with model platforms and with your existing GRC or MRM system of record |
AI Governance and Model Risk Platform Vendors
The platforms profiled below come from large, established software providers whose products buyers in this category are likely to come across, whether or not they shortlist them. Each profile is drawn from the vendor's own website and documentation, read in October 2026. The labels describe each product's starting point, not its market position. Specialist vendors are listed after the profiles. Inclusion in either list is not paid for, and no vendor's placement affects what this guide says.
IBM watsonx.governance
AI governance platformSAS Model Risk Management
Model risk platformServiceNow Super Intelligence Control Tower
AI governance platformOneTrust AI Governance
AI governance platformCollibra AI Command Center
AI governance platformMoody's model risk management solutions
Credit model riskOther vendors. Specialist model risk, AI governance and AI monitoring vendors reviewed for this guide, listed alphabetically: Asenion (formerly Fairly AI), CIMCON Software, Credo AI, DataRobot, Domino Data Lab, Fiddler AI, Holistic AI, ModelOp, Monitaur, Solytics Partners, Trustible, ValidMind, Yields.
Implementing an AI Governance and Model Risk Platform
The sequence below is Finantrix's recommendation. How long each phase takes depends mostly on how complete your existing inventory is.
Register every model and AI use case, including vendor models, AI embedded in software you already buy, and generative AI tools in use. Agree a tiering scheme before configuring workflows, because every later step depends on it.
Decide which instruments apply to which legal entities and products, and map them to controls. Record explicitly how you will govern generative AI and agents, since SR 26-2 leaves that to your own framework.
Set up independent review workflows with separated roles, the test libraries for each tier, generative AI evaluations, and unfair-discrimination testing where insurance rules require it.
Connect production monitoring, set thresholds that open findings or trigger revalidation, monitor vendor models on your own outcomes, and apply agent permissions and logging.
Build board reporting, the annual review, and the evidence an officer needs to sign an attestation where a regulator requires one, as Colorado does.
RFP Questions for AI Governance and Model Risk Platforms
Questions written for this category. Ask vendors to answer with a demonstration on your own examples rather than a slide.
Frequently Asked Questions
What replaced SR 11-7?
On April 17, 2026 the Federal Reserve, the OCC and the FDIC issued revised guidance on model risk management, SR 26-2 at the Federal Reserve, which supersedes and replaces SR 11-7 and SR 21-8. The FDIC rescinded its earlier adoption of SR 11-7 the same day.
Does SR 26-2 cover generative AI and AI agents?
No. The guidance states that generative AI and agentic AI models are not within its scope, and that a banking organization's own risk management and governance practices should determine the controls for them. It applies to traditional models and to non-generative, non-agentic AI models.
What is the difference between model risk management software and AI governance software?
Model risk management platforms are built around a model inventory, independent validation and ongoing monitoring, as bank supervisors expect. AI governance platforms are built around enterprise AI use-case intake, policy and control mapping, and approvals, and most do not include a bank-style validation workflow. Several vendors now cover parts of both.
When do the EU AI Act's high-risk rules apply to credit scoring and insurance pricing?
Under Regulation (EU) 2026/1744, the high-risk obligations for AI systems listed in Annex III, which include creditworthiness assessment of individuals and risk assessment and pricing for life and health insurance, apply from December 2, 2027.
How We Evaluate
Bars are scaled to the heaviest criterion. The percentages are the real weights and add up to 100%.
We write these guides for people running a software selection. This one covers 6 platforms and should save you weeks of research, but it will not replace your own reference calls and a proof of concept.
We review vendors' websites, product documentation and press releases, along with regulatory texts and other publicly available information. Our assessments are our opinion. No vendor supplied them and nobody audited them. Use them to build a shortlist, then go and test it yourself.
The criteria weights are ours as well. We chose them for this category and publish them so you can see what we valued, and weight things differently if your situation calls for it.
No vendor pays to appear in this guide or to be described the way it is. Spotlight placements alongside our guides are paid and labeled as paid placements, and they change nothing about the evaluation.
Last reviewed November 2026. Enterprise software moves quickly and pricing is negotiated rather than listed, so parts of this will age. If we have something wrong, tell us and we will fix it. That goes double if you work for a vendor we cover.