Model inventory
Also called model register, model catalogue
A model inventory is a firm-wide register of every model a bank or financial firm has in development or in use. It records what each model does, who owns it, how material and complex it is, and when it was last validated. It is the starting point for model risk management and AI governance.
How it works
Firms first decide what counts as a model, then find them across the business, including spreadsheets, vendor tools and AI systems that teams may have adopted on their own. Each entry records the model's purpose and intended use, owner, developer, users, data inputs, dependencies on other models, risk tier, validation status, performance monitoring, limitations and any adjustments or overlays applied. Vendor models are included even where the code is not visible.
The inventory drives the rest of the framework. Risk tiers decide how deep and how often validation happens, and overdue reviews, open findings and models used outside their approved scope show up as exceptions for the model risk function. Senior management and the board use aggregated views to understand total model risk. Supervisors ask for the inventory early in examinations, and gaps or inconsistencies between tiering policy and inventory data are a common finding.
The rules
Replaces SR 11-7 and SR 21-8; states that an effective model inventory includes enough information to understand model risks at individual and aggregate level. Generative and agentic AI models are outside its scope.
Banking organisations supervised by the agencies, mainly those with over $30 billion in assetsExpects a firm-wide model inventory recording each model's purpose, intended use, operating boundaries, risk tier, adjustments and interdependencies, supporting a view of aggregate model risk.
UK banks, building societies and PRA-designated investment firms with internal model approvalCommon questions
What should a model inventory include?
At a minimum: model name and purpose, owner and developer, intended use and users, data inputs, dependencies, risk tier, validation date and outcome, open findings, monitoring results, known limitations and any adjustments. Larger firms add vendor details and regulatory uses.
Should AI systems be in the model inventory?
Most firms record AI and machine learning systems in the inventory or in a linked AI register. In the US, SR 26-2 leaves generative and agentic AI outside its scope, so firms govern those under separate AI frameworks, often using the same inventory.
Who owns the model inventory?
The model risk management function usually owns the inventory and its standards. Model owners in the business keep their entries accurate, and internal audit checks completeness.
