In plain English
Model validation tests a model's design and assumptions, the quality of its data, its implementation and its results, and whether it is used for the purpose it was built for. It happens before a model is used, and again periodically and whenever the model changes.
It is carried out by people independent of those who built the model, and the depth should match the model's materiality. The term is used for credit and risk models, fraud and transaction monitoring models, and increasingly for AI.
Why it matters to a board
A model nobody has independently challenged is a risk the institution has not measured. Supervisors increasingly ask for evidence that models, including AI models, have been validated and that findings are closed.
Common mistakes
- Developers validating their own work.
- Validating once and never again, even after the model or data changes.
- Leaving findings open for years.
- Treating vendor assurance as validation.
What the standards and regulators say
- Central Bank of the UAE: Model Management Standards and Guidance (issued December 2022). See the CBUAE Rulebook
- OCC Bulletin 2026-13 and Federal Reserve SR 26-2: model risk management guidance (17 April 2026), which replaced SR 11-7 and excludes generative and agentic AI from its scope
- NIST Artificial Intelligence Risk Management Framework 1.0 (NIST AI 100-1)