A regional bank with a growing set of customer-facing AI models learned it would face a regulatory examination of its model risk practices in five months — and had no consistent way to classify which models needed the deepest scrutiny.
Building an AI Risk-Tiering Framework Ahead of a Regulatory Audit
Service Provided
Capabilities Utilized
Model Risk Management, Regulatory Readiness, Governance Design
Client challenge
The bank’s AI models ranged from a low-stakes internal document summarizer to a credit-decisioning model directly affecting customers, but all were reviewed with the same lightweight process. Examiners were expected to ask for risk tiering, documented model cards, and evidence of ongoing monitoring — none of which existed in a defensible, consistent form.
Our solution
We designed a four-tier risk classification framework based on customer impact, decision autonomy, and data sensitivity, then applied it retroactively across the bank’s full model inventory. Each model above the lowest tier received a standardized model card documenting its purpose, training data lineage, known limitations, and monitoring cadence.
We also built a lightweight recurring review cycle so tiering wouldn’t go stale after the audit — new models are classified at intake, and tier assignments are revisited any time a model’s use case changes.
Results
The bank entered its examination with a fully tiered model inventory, model cards for all 34 in-scope models, and a documented review cadence — addressing what examiners had flagged as a gap at a peer institution the year before. The exam closed with zero governance-related findings, and the tiering framework has since become the bank’s standard intake process for any new AI initiative.
Additional Case Studies
Launching a Usage-Based Pricing Model for an AI Developer Platform
An AI developer platform’s flat-tier pricing was leaving money on the table with its largest customers
Establishing an Enterprise AI PMO to Track ROI Across 30 Initiatives
A global enterprise had 30 active AI initiatives across its business units but no consistent way
Building the Product Operating Model for an Agentic SaaS Vendor
A vertical SaaS vendor had shipped an early agentic feature that could autonomously complete customer workflows,
