Model risk & validation for agents
Validation frameworks written for systems that score, applied to systems that act.
The problem
Model risk guidance was written for systems that score and predict. Your agents act. In April 2026 the federal banking agencies replaced fifteen years of that guidance — and expressly placed generative and agentic AI outside its scope, with separate rules promised. That is a deferral, not an exemption: every obligation attached to the action still binds, but the specification that would have told you what adequate looks like is gone. This lane is the one the rest of the site already covers in depth, because it is where the four-layer method lives; this page exists to place it in the stack rather than to repeat it.
Where it breaks
Inventory
Most model inventories cannot represent a system that chains tools, prompts and sub-models at runtime.
Validation
You validated the model. Nobody validated the agent's authority — and a well-scored model wrapped in an agent that can act outside its grant is a governance failure with excellent metrics.
Effective challenge
Challenge assumes the reviewer can reconstruct the decision. If the agent's context is gone, so is the evidence.
Monitoring
Model performance drifts slowly. Agent behavior changes the day a provider ships a new version, with no code change and often no revalidation trigger.
Standards and regimes named on this page are checked against their primary sources on an ongoing basis. Instruments move — several cited here changed inside the last year — so verify against the source before you rely on one. If you find something stale, tell me and I will correct it.
Where does this sit in your estate?
The useful version of this conversation is specific — one workflow, one deadline, one thing you are not sure you could evidence. That is usually twenty minutes.