CJ
What are the model risk management requirements under SR 11-7 for our credit scoring model, and which apply before we can promote CS-204 to production?
neurology
AveryVirtual expert
SR 11-7 frames model risk management around three pillars: robust model development, ongoing validation, and governance with clear accountability. For CS-204, the controls that gate production sit in the first two pillars.
An independent validation covering conceptual soundness, outcomes analysis, and monitoring design is required prior to deployment, performed by staff independent of model development. Development documentation must let a third party reproduce the model without recourse to the developers.
Because CS-204 informs consumer credit decisions, fair lending testing and a documented effective challenge record should be attached to the validation package. Your MRM policy also requires Tier-1 models to carry a board approved risk rating, which CS-204 currently lacks.
Executive summary
Bottom line: CS-204 cannot be promoted until independent validation is complete and a board approved Tier-1 rating is issued.
- check_circleIndependent validation is mandatory pre-production.
- check_circleReproducible development documentation must accompany the package.
- check_circleFair lending testing required for consumer-credit use.
- check_circleOpen blocker: no board approved risk rating on file.
Outline
- chevron_rightSR 11-7 three-pillar framework
- Development · validation · governance
- chevron_rightPre-production gates for CS-204
- Independent validation · reproducible documentation
- chevron_rightConsumer-credit considerations
- Fair lending testing · effective challenge
- chevron_rightOpen blocker: Tier-1 board rating
account_treePremise chain
CS-204 is classified a Tier-1 model under MRM policyT1
Independent validation is required before productionT1
Tier-1 models require a board-approved risk ratingT2
CS-204 has no board-approved rating on fileT1
privacy_tipOne identifier was redacted by your base policy. For an authorised task, declare a purpose to access it; the exemption is recorded.
verified_user
Validity warrant issued
2026-06-17 09:42 · WRNT-204-7 · requested by CJ (RM), in policy
Warrant scope:
This answerConversationDecision
grid_onRisk register rowfields mapped from this answer
infoEach field is mapped and editable before export. New templates are added under Take action → Manage templates.
CJ
Who has to sign off the validation, and can development staff do it?
neurology
AveryVirtual expert
Sign-off must come from a validation function that is independent of model development. Developers may support the exercise but cannot own the validation conclusion or the effective-challenge record.
gavel
SR 11-7: Guidance on Model Risk Management
gavelFederal Reserve · Regulation · pp. 3–7
…validation should be performed by staff who are independent of model development, covering conceptual soundness, ongoing monitoring, and outcomes analysis…
Why relevant: directly defines the independent-validation requirement and who may perform it.
rule
Independent Validation Standard MRM-STD-02
ruleInternal · Policy · §4.2
…the scope of an independent validation shall include benchmarking, replication where feasible, and an assessment of requirements for ongoing monitoring…
Why relevant: your internal standard operationalising the regulator's expectation.
description
OCC Bulletin 2011-12
descriptionOCC · Regulation · supervisory
…supervisory expectations for validation activities, including effective challenge by parties independent of the model owners…
Why relevant: companion supervisory guidance reinforcing effective challenge.
menu_book
Outcomes Analysis Playbook
menu_bookInternal · Method · v2
…operational guidance for the validation team performing outcomes analysis and back-testing…
Why relevant: method-level detail, useful but not authoritative on requirements.
CJ
Map EU AI Act Articles 9–15 obligations to our internal model-risk controls and flag any requirements we do not yet cover.
travel_explore
AveryDeep research
helpClarified before starting
Which articles are in scope?Art. 9–15 (risk, data, documentation, transparency, human oversight)
What output do you want?A control-mapping table plus a list of gaps
How deep, and which sources?Standard depth · prefer T1 and T2 · internal policy first
account_treeReasoning plancaptured and preserved with this inquiry
check1 · Plan. Broke the objective into seven sub-questions, one per article cluster.0:08
check2 · Initial search. Retrieved the EU AI Act text and 38 internal control and policy sources.0:51
check3 · Reflect. Assessed coverage and trust tier; two clusters were thin on internal evidence.1:20
check4 · Follow-up. Ran four targeted searches for human-oversight and record-keeping controls.2:05
check5 · Synthesise. Aligned each obligation to a control and flagged the unmapped ones.2:48
progress_activity6 · Improve. Running a sub-plan to confirm the two gaps are not covered elsewhere.71%
7 · Choose format. Mapping table plus gap list, as requested.queued
8 · Produce output. Render the report and issue a validity warrant.queued
Draft, updating as the run completes. Articles 9–15 map cleanly onto existing model-risk controls in most areas. Two obligations have no current internal control and are flagged below.
| EU AI Act obligation | Internal control | Status |
|---|---|---|
| Art. 9 · Risk management system | MRM-STD-01 model risk framework | Mapped |
| Art. 10 · Data and data governance | DATA-GOV-03 data quality and lineage | Mapped |
| Art. 11 · Technical documentation | CS-204 development record v4 | Mapped |
| Art. 12 · Record-keeping and logging | — | Gap |
| Art. 13 · Transparency to deployers | MODEL-CARD-02 disclosure pack | Mapped |
| Art. 14 · Human oversight | — | Gap |
| Art. 15 · Accuracy and robustness | MRM-STD-02 validation standard | Mapped |
Two gaps to close. Article 12 needs a defined automatic logging and retention control for the model's decisions, and Article 14 needs a documented human-oversight procedure for the credit-decisioning use of CS-204.
Executive summary
Bottom line: five of seven obligations under Articles 9–15 are already covered; two require new controls before deployment.
- check_circleMapped: risk management, data governance, documentation, transparency, accuracy.
- check_circleGap: Article 12 logging and retention control.
- check_circleGap: Article 14 human-oversight procedure.
Outline
- chevron_rightCoverage of Articles 9–15
- Five obligations mapped to existing controls
- chevron_rightGaps
- Art. 12 logging · Art. 14 human oversight
- chevron_rightRecommended next steps
- Draft two controls · re-run mapping
verified_user
Preview warrantchevron_right
Validity warrant issued on completion
RES-118 · pending final step
Vault
Your private materials · 1,204 files · 3.8 GB
cloud_sync
Local Drive · /Compliance
running · 1,204 discovered · 892 indexed · 312 queued
ruleInclude: *.pdf, *.docxblockExclude: /archivelayersDepth 3 · 5k pagesgroupsShare → CompliancetuneSelection criteria
how_to_reg14 nominated for approval
public
Regulator sites · scheduled
paused · next run daily 06:00 · recursion 2
listSeeds: 6 URLsaccount_treeTopics: Model Risk, Basel IVgroupsShare → all collections
hard_drive
Local Drive · /Compliance
892 files · last sync 4m ago · auto-crawl on
cloud
SharePoint · Risk
connected · scoped to /Risk/Policies
Drives are added in one place: the Connect a drive button above. Scope, schedule, and sharing are set per drive.
Topics
Subjects you follow · drives discovery, monitoring, and News
Prudential
AI & Models
Suggested for you
addOperational ResilienceaddClimate Risk DisclosureaddCCAR / Stress Testing
The projection is relative to the current context. Drill into a node to focus it; the breadcrumb tracks where you are. Switch the projection type above.
News
Updates from your monitored topics · Today
EUR
EU AI Act T1 source
Delegated act on high-risk AI classification published
European Commission·2h ago
Abstract: The Commission sets the criteria and conformity steps for high-risk AI systems, tightening how credit-decisioning models are classified and what evidence must accompany them before deployment.
Why relevant: affects how CS-204 is classified; 4 sources in AI Governance may need re-validation.
Suggested inquiries
question_answerDoes this reclassify CS-204?question_answerWhich controls need re-validation?
OCC
Model Risk T1 source
OCC signals refresh of model risk management expectations
OCC·Yesterday
Abstract: The OCC flags a forthcoming update to supervisory expectations for model risk, with emphasis on validation independence and ongoing monitoring cadence.
Why relevant: touches your most-cited branch; may change validation cadence.
IND
Model Risk T3 source
Industry blog: practitioners debate validation independence
RiskBlog·2 days ago
Abstract: A practitioner roundup of how firms staff and scope independent validation, with varied interpretations of who may sign off.
Why relevant: contextual only, not authoritative. Use Open case to Steward to request this source be vetted.
Dismissed stories are kept in When → Dismissed and on the source's history, so a source is never silently dropped.
Cases
Issues and help requests raised to the Steward
CASE-204 · Fair lending source disputed
hourglass_topTriageSource dispute·2m ago
CASE-198 · Benchmarking gap escalation
errorOpenData gap·1h ago
CASE-191 · GDPR Art. 22 interpretation
check_circleResolvedHelp request·3 days ago
Curation queue
Approve, hold, or re-source what is waiting · changes preview before they commit
Waiting
7
trending_down5 resolved
User suggestions
3
trending_up+1
Open gaps
23
north_east2 new
Conflicts
4
north_east1 new
Coverage
Declared, observed, and available coverage on each managed dimension
Coverage
87%
trending_up+4.2 pts
Declared dimensions
6
radargeography, framework…
Thin areas
3
north_eastAI Gov, AML
Decaying items
12
trending_downrefresh due
Coverage radardownload
Observed against declared, per dimension
Observed Declared
Branch coverage
Trust-tiered source coverage per branch
Capital & LiquidityBasel III / IV
94%
Model Risk MgmtSR 11-7 / OCC
90%
Data PrivacyGDPR / CCPA
88%
Financial CrimeAML / KYC
72%
AI GovernanceEU AI Act
61%
Causal graph
Claims sized by epistemic gravity, coloured by trust tier
Claims
1,284
trending_up+36
Load-bearing
38
fitness_centerhigh gravity
Conflicts
4
north_east1 new
Decaying premises
12
trending_downrefresh due
Claim graph
Node size is gravity; colour is trust tier
T1T2T3T4
Beliefs
Managed premises, revise or untrust with preview
Sources
Source health, trust tier, freshness, and validity
Sources
503
trending_up+18
T1 / T2
412
shield82%
Stale
21
schedulerefresh due
Unreachable
3
link_offre-source
Recipe
Knowledge as code: the base defined, versioned, validated, and promoted
Recipe as coderecipe.yaml
Declarative and version-controlled
scope: domain: Risk & Compliance dimensions: [geography, framework, time, sector, authority, topic] sources: - id: fed-sr-11-7 tier: T1 monitor: weekly - id: occ-mrm tier: T1 monitor: weekly collection: web: exa + google_grounded intranet: crawl4ai exclude: [/archive, opinion-blogs] governance: veracity_gate: 0.7 pii_detect: on_ingestion pii_default: redact pii_purposes: [kyc, onboarding] warrant: on_answer
Components
Navigate and edit the same recipe
Version history
Each revision is a commit; roll back if needed
Promotion
Move this recipe along the environment path
DEV · v14arrow_forwardUAT · v14arrow_forwardPROD · v13
Promotion is preview-first: a recipe diff is shown, approval is required, and the apply writes a warranted audit entry. Environments are managed under Admin.
Agents
Background agents and the loops that keep the base full and honest · no content shown
Active agents
14/16
bolthealthy
Queue depth
312
trending_down-44
Ingest rate
1.2k/min
trending_upsteady
Errors (1h)
3
trending_downcontained
Jobs & schedules
Scheduled and triggered work, and retention
Running jobs
7
bolthealthy
Scheduled
12
schedulenext 06:00
Failed (24h)
2
trending_downretried
Retention
365d
lock_clockwarrants ∞
Budgets & circuit breakers
Caps that trip loudly, token budgets, and autonomy levels
Daily spend
$48
paymentsof $120 cap
Breakers tripped
0
check_circlenominal
Retraction cap
25/day
undo6 used
Cascade depth
4
account_treemax
Circuit breakers
Trip loudly and pause the pool
Daily spend$48 of $120
40%
Retractions6 of 25
24%
Cascade depth3 of 4
75%
Error ratecontained
12%
Autonomy & budgets
Per-agent authority and token budget
discovery-webL1
crawler-localL2
review-inconsistencyL0
Access & personas
Relationship-based access, scoped per knowledge base, for people and agents
Users
86
trending_up+4
Stewards
7
account_tree2 bases
Agent tokens
11
keyscoped
Pending
2
hourglass_emptyinvites
Knowledge bases
One installation, many bases, per-user access
databasecheck_circleHealthy
Risk & CompliancePROD
503 sources · 1,284 claims · 86 users · shared pool
databasecheck_circleHealthy
Markets & TreasuryPROD
214 sources · 540 claims · 31 users · isolated
sciencebuildBuilding
SandboxDEV
42 sources · 110 claims · 5 users · shared pool
Environments
Promote recipe code from development to production, backed by a git repository
Environments
3
lanDEV · UAT · PROD
Recipe version
v14
commitmain
Pending promotions
1
north_eastUAT → PROD
Drift
0
check_circlein sync
Environments
Recipe version deployed in each
Recipe repository
Recipes are versioned as code
hubgithub.com/acme/corvair-recipesmain
commitv14: add EU AI Act monitoring + tier rules2h ago
check_circleCI: recipe validated, 0 errorsverifiedPassing
Promotion pipeline
Move a validated recipe along the path; each promotion is recorded
DEV · v14arrow_forward
UAT · v14arrow_forward
PROD · v13
Promotions are preview-first: the recipe diff is shown, approval is required, and the apply writes a warranted audit entry. Rollback returns the environment to the previous tag.
Validity warrants
Signed, replayable records: read, verify, and export
Warrants (30d)
1,942
trending_up+128
Verified
1,942
check_circle100%
Failed verify
0
verified_userchain intact
Exported
37
outboxto reviewers
Framework crosswalks
Coverage against a reporting framework, requirement by requirement
grid_onFramework: SR 11-7
Requirements
42
checklistSR 11-7
Covered
36
trending_up86%
Disclosure gaps
6
north_east2 high
Last reviewed
3d
historyA. Reyes
Conflict map
Contradictions, single-source dependencies, and decaying premises
Conflicts
4
north_east1 new
Unresolved
3
pendingin triage
Single-source
9
linkdependencies
Decaying
12
trending_downpremises
Validity landscape
Trust and decay across the base, as terrain
eventAs of: today
High validity
71%
trending_upstable
At risk
17%
scheduledecaying
Low / flagged
12%
north_eastreview
Snapshot
live
replayreplayable
Decay terraindownload
Height is validity; lower areas are decaying
Decaying premises
Load-bearing items losing confidence
occ.gov MRM94d since validation
48%
Internal note120d
30%
Vendor packunreachable
10%
Settings
Your profile, knowledge bases, notifications, and defaults
Profile & preferences
How you appear and your defaults
Chris Jackson
ckjackson@corvair.ai
Language
Locked to English in this release
EnglishlockOthers
EnglishlockOthers
Interface and answer language are fixed to English for now. Additional languages will unlock these settings.
Appearance
Theme, text size, and answer defaults
CompactDefaultLargeLarger
MarkdownExecutiveOutline
Knowledge bases & drives
What you are connected to
Risk & CompliancePROD
Markets & TreasuryPROD
Notifications & digest
Background jobs and news
Background job completion
Monitored news
Privacy & PII
Governed by your base policy and role · set by your steward and administrator
Default handling for your roleRedact
Detection on ingestionOn · set in the recipe
Purposes you may declareKYC, Onboarding
You cannot change these here. Detection and the redact, block, or allow policy are configured by your steward during base setup and granted per role by your administrator. Where your role permits, you declare a purpose at the point of use; the exemption applies to that one task and is recorded in the warrant.
Access & sign-in
Identity and connected tools
Single sign-oncheck_circleActive
Personal access token