Key concepts

The governed unit depends on who's asking. US bank guidance governs a "model", which the April 2026 text narrowed to complex quantitative methods built on statistical, economic or financial theory, leaving out spreadsheet arithmetic, deterministic rules and generative AI. Canada's OSFI E-23 widens "model" to include AI and machine learning methods and judgment-based tools. The UK's PRA covers vendor models "regardless of technology". The EU AI Act, NIST and ISO 42001 talk about an "AI system", and most company registers track a use case. I'd key the register on the use case (purpose, users, data, decisions affected) and link models, vendors, prompts and datasets to it, because one model serves many use cases and one use case can swap models.

Roles carry identity too. Banks name a model owner, developer, validator and user. The EU separates the provider, who places a system on the market under its own name, from the deployer, who uses it professionally, and those roles attach per system and can flip. US law keys on the decision-maker's legal role (creditor, employer, insurer, health care provider) and now pulls vendors in as the employer's "agent" (Workday, California's rules), as a consumer reporting agency (a theory in a 2026 suit against Eightfold) or under housing law (SafeRent). For each use case I'd write down which entity decides and which vendor a court could call its agent.

A use case moves through discovered, proposed, in assessment, approved with conditions, live, under review or suspended, changed and re-validated, retired and archived. The April 2026 US guidance is silent on retirement; Canada's E-23 has an explicit decommissioning stage. Vendors run their own states on their own clocks (active, legacy, deprecated, retired, meaning slightly different things at each lab and cloud), and those states drive yours.

Laws have lifecycles too: Colorado's AI Act was enacted in 2024, delayed, paused by a court stipulation, then repealed and replaced in May 2026. Most AI lawsuits in 2026 sit between discovery and class certification, and an ISO 42001 certificate lasts three years, with a surveillance audit each year.

The inventory is the ledger. US bank guidance wants enough information to understand model risk "at the individual and aggregate levels", and E-23 lists required fields. The fields I'd keep:

Even banks keep it in modest tools: in Deloitte's 2025 survey of 87 banks in Europe, the Middle East and Africa, 24% still used Excel as their main model risk tool. The evidence itself lives in eval runs, traces, tickets and logs.

Litigation turns these records into evidence. Cigna produced about 2.1 million pages in a suit over its claim-review algorithm, and Workday was ordered to produce its federal equal-employment reports. Retention rules set the floor: six months for EU deployer logs of high-risk systems, four years for automated hiring data in California. The test I'd use: if a court asked for every input and output for one applicant from 2024, could we produce them?

The policy stack runs from an AI policy and an acceptable-use policy down to tiering rules, an approval matrix and vendor standards; in a bank it sits next to the model risk policy. The operational pieces lag: in a 2026 survey by Schellman, which sells ISO 42001 audits, 44% of US companies with 500 or more staff had incident procedures specific to AI.

Tiering combines an outside screen with an inside score. US bank guidance measures materiality as exposure plus purpose, with inherent risk on top; E-23's inherent risk rating sets review intensity, documentation, the approver and monitoring; the EU tiers by use.

The binding rule often sits in a consent order or a contract instead of a statute. Massachusetts' settlement with Earnest, a student lender, requires an AI inventory, risk assessments, testing, documentation and an oversight team, which reads like a bank model risk program. Labs' usage policies require human review in credit, employment, insurance, housing and health, and customer contracts add their own conditions on top.

Dates I'd keep on a calendar as of October 2026:

Dates here slip often: Colorado's moved twice, the EU's high-risk date by 16 months, and the Commission's guidelines on classifying high-risk systems, due by February 2, 2026, came out as a draft in May. Vendors' retirement dates are often "not sooner than" dates.

The interface that matters most is the crosswalk between frameworks (NIST publishes one to ISO/IEC 23894), and vendors sell "map once, comply many". Questionnaires still travel as spreadsheets and portal forms. Model cards, labs' system cards and the EU's technical file describe a model, and none of them is a validation report.

Inside the company, banks use the "three lines" model, and other companies copy it loosely:

Outside banks, privacy teams and legal or compliance teams each own AI governance in about a fifth of companies, ahead of IT, in the IAPP's 2025 survey. Around the company sit labs and clouds, SaaS vendors with AI inside, assurance firms, certification bodies and their accreditors, regulators, customers' procurement teams, plaintiffs' lawyers and insurers. Supply is concentrated: in the Bank of England and FCA's 2024 survey, the top three model providers made up 44% of all the model providers UK financial firms named.

One hiring decision in New York by a company based in the EU can touch the AI Act, GDPR, three federal statutes, state and city human-rights law, the city's bias-audit law, FCRA and the vendor's contract.

A rule withdrawn in Washington doesn't remove the statute behind it, and states and private plaintiffs can still sue.

The law reaches whoever makes or shapes the decision about a person: the deployer by default, and more and more the application vendor whose tool scores, ranks or screens. Model labs sit behind usage policies and caps of about a year of fees, and I found no case where a lab was held liable for a deployer's decision about a person. So the evidence splits: the deployer keeps the inventory, oversight design, notices, outcome monitoring and records; the vendor keeps testing, documentation and intended-use limits; contracts decide who pays between them. Vendors' certificates don't move this: AWS says customers aren't "automatically certified by association" with its ISO 42001 certificate.