AI risk management needs to move beyond individual models
As financial services firms accelerate their adoption of AI, the traditional model of risk management is no longer enough to understand the risks the technology creates across a business. Chris Warhurst, technical director at 4most, argues that as firms become increasingly sophisticated at assessing individual AI use cases, a bigger risk is being overlooked: what happens when dozens, or even hundreds, of AI systems begin interacting across different teams, products and decisions.
Across financial services, artificial intelligence is moving rapidly from targeted experimentation to enterprise-wide deployment. Applications that began in areas such as fraud detection and customer servicing are increasingly being embedded in core operations and decision-making.
This creates a challenge for risk functions. Firms have become increasingly practised at assessing individual AI models, but many have less visibility of their aggregate exposure once multiple systems are operating across the organisation. A model may perform as expected in isolation while contributing to risks that only become apparent when AI is deployed at scale. For boards and senior risk leaders, understanding that wider exposure is becoming increasingly important to effective AI governance.
Traditional model risk management remains an important foundation for AI oversight. However, it was largely designed around individual models that could be validated, approved and monitored within defined boundaries.
AI is increasingly operating across those boundaries. Systems may draw on shared data, rely on common third-party platforms or influence decisions across several functions. This creates interactions that are difficult to capture through individual model reviews.
A firm could therefore have a portfolio of AI systems that have each passed their respective approval processes, while lacking a clear picture of how their combined use affects customers, operations or the wider business.
This is particularly relevant as firms adopt generative AI and other technologies that can change rapidly, interact directly with users and be deployed across multiple business areas. The challenge becomes one of understanding how risk behaves across the ecosystem rather than within a single use case.
How risk accumulates across the organisation
Several established risk categories illustrate the issue, with data being one example. Poor-quality or inadequately governed data can affect multiple systems when the same sources are used across the organisation. An issue that appears contained within one application can therefore propagate into downstream decisions.
Third-party dependency presents a similar challenge. Financial institutions are increasingly reliant on external AI models and cloud platforms, creating questions around transparency, resilience and concentration. These dependencies can sit beyond the scope of an individual model review.
Cyber risk is also evolving as AI enables more sophisticated phishing, deepfake fraud and other attacks. A vulnerability in a shared technology or supplier ecosystem can affect multiple parts of an organisation, creating exposure that is difficult to understand from a model-level perspective.
Conduct and operational risks can accumulate in similar ways. Automated decisions may appear reasonable when assessed individually but produce inconsistent or difficult-to-explain outcomes when deployed across different customer journeys or business processes.
These risks are familiar to financial services. AI is changing their scale, speed and interconnectedness. This accumulation creates a visibility challenge for boards. Individual model approvals provide useful assurance, but they do not necessarily answer broader questions about how much AI is being used, where exposure is concentrated or who is accountable when something goes wrong.
As AI becomes embedded in credit decisions, customer interactions and internal operations, boards need a consolidated view of the firm’s AI landscape and associated risks. This should include an understanding of where AI is deployed, how material those uses are, which systems and suppliers they depend on, and how accountability is allocated.
Without that visibility, firms can make sound decisions about individual deployments while missing the wider risk picture.
Building an enterprise-wide approach
Addressing this requires AI governance to extend beyond individual model approval. Firms should develop a clear inventory of AI use across the organisation and consider how systems interact across business processes, data environments and third-party platforms.
Ongoing monitoring is equally important. AI systems can evolve after deployment, while their risk profile may change as they are integrated into new processes or used for different purposes. Validation and assurance therefore need to reflect how systems operate in practice, rather than relying solely on periodic, point-in-time assessments.
Clear human oversight and escalation routes are also essential. As automation increases, accountability needs to remain with identifiable individuals and functions who can challenge outputs and intervene when risks exceed agreed thresholds.
Third-party arrangements warrant particular attention, given the growing reliance on external AI and cloud providers. Firms need sufficient visibility of how these services are developed, updated and controlled, alongside appropriate contingency and exit arrangements.
Handled well, this approach can support innovation rather than constrain it. Strong governance gives firms a clearer understanding of where AI is being used and how risk is developing, allowing adoption to scale with greater confidence.
As AI becomes an increasingly important part of financial services, organisations will need to look beyond individual models and develop an enterprise-wide view of how AI is being deployed, governed and relied upon.
