A demonstration in April 2026 tested a publicly available underwriting dataset from 2015 against a current population. The model was under-classifying risk. In a real deployment, that is premium left on the table every day, with no alarm going off.
A regulatory framework exists to catch exactly this kind of drift.
The framework was written for a different kind of model
SR 11-7 has governed how banks validate quantitative models since 2011. Most teams treat it as a documentation exercise: model inventory, independent validation, annual review, box checked.
That works for a regression model. It does not work for AI.
SR 11-7 was written for stable, explainable models with explicit coefficients and known inputs. Machine learning models drift. They find proxies nobody programmed. They can encode protected characteristics through zip code, device type and spending patterns, and nobody flags it until someone goes looking.
Since 2011, the 2021 Interagency AI/ML Statement, CFPB Circular 2022-03 and the NIST AI RMF have each extended the same expectation: a bank needs to know what its model is doing to the people it touches.
Disparate impact testing is now a regulatory obligation.
Nobody owns the intersection
In most banks, the model risk team owns SR 11-7. The fair lending team owns ECOA. The AI team owns the model. Nobody owns the intersection.
The validation report gets filed. The bias section says "not applicable." The exposure remains.
The question that matters in these reviews is about output, not documentation: "Have you tested the distribution across protected classes?"
That is SR 11-7 working the way it was intended.
Governance keeps banks out of consent orders
Governance does not slow AI down in financial services. It keeps a bank out of a consent order.
A model validation that does not cover bias testing is more than an SR 11-7 gap. It is a fair lending exposure.