AI Model Risk: The UK CIO and CRO Governance Agenda for 2026

AI model risk is now a formal regulatory expectation for UK enterprises. The PRA’s Model Risk Management Principles (SS1/23) apply directly to AI systems, and the FCA and ICO are intensifying scrutiny of automated decision-making across sectors.

For UK CIOs and CROs, the question in 2026 is not whether to govern AI model risk — it is whether your framework is audit-ready. According to the PRA’s 2026 supervisory priorities, AI model governance is now a standing topic in supervisory dialogues with UK financial services firms. Outside regulated sectors, the ICO’s enforcement record on automated decision-making sends a clear signal: enterprises without documented AI model controls face material liability.

What Is AI Model Risk — and Why Does It Sit With the CIO in 2026?

Model risk is the potential for adverse outcomes arising from decisions based on incorrect, misused, or poorly governed models. Traditionally a financial services concern — think credit scoring models or trading algorithms — model risk has expanded decisively into operational AI. Any system that uses data inputs to generate outputs that drive business decisions is, in regulatory terms, a model.

For UK enterprises in 2026, this means HR screening tools, customer churn predictors, procurement automation, fraud detection engines, and generative AI assistants embedded in business workflows all fall within the model risk perimeter. The CIO owns the technology stack. The CRO owns the risk framework. When AI sits at the intersection of both, governance gaps are almost inevitable without a deliberate joint mandate.

According to the Bank of England’s SS1/23, firms must maintain an inventory of models, assign clear ownership, conduct independent model validation, and define thresholds for model review and retirement. While SS1/23 applies directly to PRA-regulated banks and insurers, the underlying principles — inventory, ownership, validation, monitoring — represent best practice for any UK enterprise deploying AI at scale.

Executive Action:

• Commission a cross-functional review — CIO, CRO, Legal — to map every AI system currently driving business decisions against the PRA’s model risk taxonomy.
• Determine which models are in-scope for PRA/FCA oversight (all regulated firms) and which require ICO documentation under UK GDPR Article 22 (all enterprises using automated decision-making with significant effects on individuals).
• Set a board-level threshold: any AI model materially influencing revenue, risk decisions, or customer outcomes requires formal registration and a named model owner.

Which Regulators Are Watching AI Model Risk in UK Enterprises?

UK enterprises in 2026 sit within an overlap of five regulatory regimes touching AI model risk. The PRA’s SS1/23 sets the most prescriptive standard — inventory, validation, three lines of defence. The FCA’s Consumer Duty and its July 2025 AI discussion paper require firms to evidence that AI-driven outcomes are fair, explainable, and consistently monitored. The ICO’s enforcement powers under UK GDPR cover automated decision-making that produces significant effects on individuals, with fines of up to £17.5 million or 4% of global turnover.

Beyond regulators, the UK government’s DSIT AI governance framework — built on principles of safety, security, fairness, accountability, and contestability — applies to all sectors, albeit on a voluntary basis for now. The EU AI Act adds extraterritorial reach: any UK enterprise serving EU customers or deploying AI systems in the EU faces mandatory conformity assessments for high-risk AI systems from August 2026.

According to research by Aon published in 2026, 78% of UK business leaders identify AI risk as a top-three enterprise risk, yet fewer than a third have a documented AI model risk policy reviewed by the board. This gap between risk recognition and governance maturity is precisely the exposure that regulators are looking for.

Executive Action:

• Map your AI model estate against all five regulatory regimes — PRA SS1/23, FCA Consumer Duty, UK GDPR Article 22, DSIT AI principles, and EU AI Act — to identify the most demanding applicable standard for each model.
• Ensure your CRO and General Counsel are jointly briefed on EU AI Act obligations before the August 2026 high-risk AI deadline, even if your primary operations are UK-based.
• Present a model risk regulatory map to the Risk Committee at the next scheduled meeting, with a clear RAG status for each regime.

How Should UK CIOs Structure an AI Model Risk Governance Framework?

Effective AI model risk governance applies the three lines of defence model to AI systems. The first line is operational ownership: every AI model requires a named model owner — typically the business unit head whose function uses the model — responsible for inputs, outputs, and downstream decisions. The CIO’s team provides technical stewardship: model documentation, version control, access management, and monitoring infrastructure.

The second line is independent risk oversight. The CRO’s function — or a dedicated Model Risk Management team — conducts periodic model validation: testing model assumptions, checking for data drift, and reviewing whether model outputs remain appropriate for the business context in which they are applied. For generative AI, this is more complex than for traditional statistical models, because large language model outputs are probabilistic and context-dependent. Validation must test for hallucination rates, bias, consistency, and alignment with defined use cases.

The third line is internal audit — providing independent assurance that the governance framework is operating as designed, and that model risk controls meet the standards expected by regulators. Annual AI model risk audits, feeding findings to the Audit Committee, are increasingly expected as standard practice.

The Cloud Security Alliance’s AI Model Risk Management Framework, published in 2025, provides a practical structure for the model inventory — covering model purpose, data inputs, decision outputs, regulatory classification, validation status, and risk rating. UK CIOs should adapt this to the UK regulatory context, adding PRA and ICO classification columns.

Executive Action:

• Build a model inventory as the foundational artefact — no governance framework functions without knowing what models exist, who owns them, and what decisions they inform.
• Establish a joint CIO/CRO Model Risk Forum meeting quarterly, with escalation paths to the Risk Committee for material model changes or validation failures.
• Define model tiers by risk level — Tier 1 (material decisions, high regulatory exposure), Tier 2 (operational automation, moderate exposure), Tier 3 (low-stakes support tools) — and calibrate validation rigour accordingly. Use our AI governance self-assessment to benchmark your current maturity.

What Are the Practical Steps CIOs Must Take Before Year-End 2026?

The immediate priority is visibility. According to McKinsey’s 2026 Global Tech Agenda, fewer than 40% of large enterprises have a comprehensive inventory of their AI and ML models in production — meaning the majority of CIOs cannot answer the most basic regulatory question: what AI are you running and who owns it?

Beyond the inventory, CIOs must establish model monitoring infrastructure: dashboards tracking model performance metrics, data quality indicators, and output distribution over time. For customer-facing AI, fairness monitoring — tracking outcomes across protected characteristic groups — is both an ICO and FCA expectation. For financial models, the PRA expects stress-testing of model outputs under adverse scenarios.

Third-party AI risk requires particular attention. If your enterprise uses AI APIs or embedded AI tools from vendors — OpenAI, Microsoft Copilot, Salesforce Einstein, or specialist vertical AI providers — you remain accountable for the outputs those systems produce in your business context. Vendor due diligence must include model documentation, bias testing results, data provenance, and contractual commitments on model change notification. Review our technology strategy review template for a structured vendor AI risk assessment checklist.

Executive Action:

• Complete your AI model inventory by Q3 2026 — a structured register of every AI system in production, with risk classification, model owner, last validation date, and regulatory classification.
• Extend your third-party risk management framework to cover AI vendors explicitly, requiring model cards, data lineage documentation, and change notification protocols as contractual obligations.
• Schedule an AI model risk briefing to the Audit Committee in H2 2026, covering inventory completeness, top-risk models, and validation findings.

INFORMD provides intelligence briefings, tools and frameworks for senior business leaders across technology, finance, strategy and compliance. Based in Milton Keynes, UK, we help executives stay informed and act with confidence. Explore our full briefing library or access our free assessment tools.

Stay ahead. Subscribe to INFORMD’s weekly executive briefing at informd.co.uk.