SS1/23 can govern a machine-learning credit model. It cannot govern a GenAI chatbot. Pick one AI system, answer ten questions, and see where the model risk framework holds, where it stops — and what has to replace it. EU AI Act, Consumer Duty and UK GDPR touchpoints are flagged for your use case.
01 Pick the Use Case
Choose the closest match. The two machine-learning cases test how well your MRM framework covers the model. The two GenAI cases show where MRM stops working, whatever you answer.
02 Answer Ten Questions
Two questions per SS1/23 principle. Answer for this one system as it runs today, not as the policy says it should.
Pick a use case and answer all ten questions.
03 Your Result
Where it would struggle
Beyond SS1/23 — touchpoints for this use case
Practitioner Insight
SS1/23 was written for models with a defined method, measurable outputs and a validation team that can open them. GenAI has none of these: one vendor model, hundreds of uses, no ground truth, and behaviour set by prompts and retrieval rather than code. Stretching the MRM framework produces documentation that passes review without controlling the risk. Keep MRM for the models it can validate. GenAI needs its own governance, built around the use case rather than the model, and connected to the existing risk framework rather than siloed from it — the FCA’s October 2026 review flags governance that operates in isolation as a weakness. Plan for the cost of running both, rather than assuming it away.
Drawing the line between MRM and GenAI?
LINXS Advisory works with banks on SS1/23 self-assessments, deciding which AI belongs in MRM and which does not, GenAI use-case governance, and group frameworks across the UK, US and EU.
This check runs entirely in your browser. Nothing you select is stored or sent anywhere. Results are indicative, based on a simplified reading of PRA SS1/23, and are not regulatory or legal advice.