Documentation your risk team can sign.
Model cards, change control and oversight designed in from the start, and mapped to the model risk framework you already follow.
What you get
The documents a model inventory typically needs.
Model card
Owner, intended use, limits, test results and known failure modes, in a format your inventory can hold.
Data and training records
Datasheets for each dataset and a training card for each run.
Risk assessment
Use-case classification, including the facts your counsel needs to decide the EU AI Act risk tier.
Change policy
Versions for the model, prompts and search index, with clear triggers for when a change needs re-validation.
Human oversight
Defined review points and thresholds, with every override logged.
Mapping to your policy
Each document mapped to your model risk policy, section by section.
EU AI Act
Is your use case high-risk?
Annex III lists use cases with extra obligations. Those most relevant to our clients:
- Credit scoring and creditworthiness of individuals
- Risk assessment and pricing for life and health insurance
- Public bodies deciding eligibility for essential services, including healthcare
- Emergency call triage and dispatch
- Hiring and employment decisions
Most back-office uses, such as document search, drafting and KYC summaries, are usually not high-risk, though they may carry transparency duties. Your counsel makes the call; we give them the facts.
Frameworks
Mapped to the framework you answer to.
| Framework | What it asks | How we support it |
|---|---|---|
| US SR 26-2 (replaced SR 11-7) | Model risk management for US banking organisations. SR 26-2 largely excludes generative and agentic AI from its formal scope; we document LLM systems to its principles. | Documentation and test evidence your validation team can use. |
| UK PRA SS1/23 | Five principles, from model identification to independent validation, covering AI and machine learning. | Each document mapped to the principle it supports. |
| MAS Guidelines on Artificial Intelligence Risk Management, FEAT and Veritas | Oversight, lifecycle controls and fairness for AI in Singapore financial institutions. | Inventory entries, lifecycle records and fairness tests. |
| EU AI Act Art. 9–15, 26–27 | Risk management, documentation, logging, oversight and accuracy for high-risk systems; duties for deployers. | Technical documentation and logs designed for these articles. |
| ISO/IEC 42001 | A management system for AI. | Our practices are informed by it. We are not certified. |
Questions
What model risk teams ask.
Under the AI Act, who is the provider?
It depends on how the system is built and branded. We set out the roles in the contract and flag when a change, such as rebranding or a major modification, would shift them.
What triggers re-validation?
A new base model, new training data, or a change that moves a key metric beyond an agreed tolerance. Minor prompt changes are logged and tested but don’t require it.
Can you support explanations for credit or claims decisions?
Yes. We log the inputs, retrieved sources, tool calls and outputs behind each decision, so your team can explain it and handle appeals. Model-generated reasoning text is recorded as an aid to review, not as a guaranteed explanation.
Do these documents replace our own model risk process?
No. They feed into it.
What we don’t promise
Some claims we won’t make.
- “EU AI Act compliant”. Compliance belongs to a specific system and a specific role.
- “ISO 42001 certified”. We aren’t.
- That our documents replace your model risk management.
Approval, without the scramble.
Bring your model risk team to the first briefing.