NIST AI RMF, GovernGOVERN 1.3

Implement a model risk materiality classification scheme that ranks the risk of each model, review it periodically, and set triggers for re-assessing a model's materiality.

You should assign each model a model risk rating based on inherent model risk, supported by clear, measurable criteria that combine quantitative and qualitative factors, and review and update the rating regularly, including when a trigger event occurs; externally developed models should be rated on a standalone basis.

You should scale the frequency, intensity and scope of model review, documentation, approval authority and monitoring to the model's inherent risk rating, and keep your model risk management capabilities appropriate to the complexity of your models, with correspondingly mature governance and oversight for extensive use of advanced AI/ML techniques.

The CBJ says you must adopt a risk-based approach and establish a framework that classifies AI applications by potential impact as low, medium or high risk and tailors oversight to each classification (section 1.3).

Adopt the statement's definition of a model as the scope of your model risk management framework, keep a complete and accurate firm-wide inventory of models in use, under development and decommissioned, and assign each model a risk-based tier by materiality and complexity, considering where necessary alternative and unstructured data and the model's interpretability, explainability, transparency and potential for designer or data bias (Principle 1).

Tailor model risk management to your model risk profile and the size and complexity of your operations, with more comprehensive and rigorous oversight for models of higher materiality.

Tailor your model risk management practices, including the frequency and nature of model validation, to your risk exposures, your business activities, and the complexity and extent of your model use.