An organisation deploys machine learning models in decisions affecting customers. What does model risk management require?

Why models need distinct governance

A model is not deterministic logic. It degrades silently as the world changes, its behaviour on unseen inputs cannot be fully enumerated, and its failures are frequently statistical rather than exceptional — so they do not raise errors, they just get worse.

Standard software controls detect crashes and defects. They do not detect a model whose accuracy has fallen on a subpopulation.

The lifecycle controls

• A model inventory. Most organisations cannot list their models, which makes every subsequent control inapplicable — and the inventory must include the ones built in spreadsheets and notebooks, which are the ones nobody governs.
• Independent validation proportionate to risk, by someone other than the developer, covering methodology, data, assumptions and performance.
• Documented purpose and limitations, stating explicitly what the model must not be used for — because reuse outside its intended context is a common failure.
• Performance monitoring in production, on the actual population, segmented — because aggregate accuracy hides degradation in a subgroup.
• Drift detection on inputs and outputs, since the world changes faster than the retraining schedule.
• A defined retraining and revalidation trigger, rather than a calendar.
• A fallback, so an unavailable or untrusted model degrades to a rule-based path rather than to an outage.

What is specific to machine learning

Training and serving must use the same feature definitions. Divergence produces silent quality loss that no test detects — the model performs well in evaluation and worse in production, for reasons that look like data drift and are actually a definition mismatch.

And the decision, not the model, is what needs governing. A low-risk model driving an automated irreversible customer decision is a high-risk system, and risk tiering that considers only model complexity misses that entirely.