The Platform PM

Glossary and sources

Field Guide

AI governance and model risk

10

Glossary and sources

6 min read · Chapter 10 of 10

Words that mean something else here

TermWhat you'd assumeWhat it means here
ModelThe weights behind an APIIn US bank guidance, a complex quantitative method based on statistical, economic or financial theory, with generative AI excluded; in Canada, AI and judgment tools included. Ask "under which definition?"
ValidationA held-out test setIn banks, an independent review of conceptual soundness, outcomes and ongoing monitoring
Effective challengeSomeone reviewed itCritical review by experts with the independence and authority to force a change
ProviderThe model labIn the EU, whoever places a system on the market under its name, which can be a bank that built it or a deployer that rebranded one
DeployerWhoever ships the codeIn the EU, the professional user of a system; in Colorado and Connecticut, whoever uses it for consequential decisions
AgentSoftware that calls toolsIn Workday and California's rules, a vendor acting for an employer, and liable as one
Bias auditAny fairness testIn New York City, a specific impact-ratio calculation by an independent auditor
Disparate impactUnfair resultsA legal theory still in the anti-discrimination statutes and many state laws, removed from Reg B and deprioritized federally
Human in the loopA person clicks approveIn EU law, a competent, trained person with authority to override; token review doesn't count
CertifiedSafeISO 42001 certifies a management system; SOC 2 is an attestation report; STAR for AI Level 1 is a self-assessment
Conformity assessmentAn outside auditFor most high-risk uses, the provider's own internal check

What surprised me

Placeholders in your voice, drafted from the research and the earlier guides. Rewrite each with your own moment.

The definition. In identity and trust a customer was a customer. Here the same AI assistant is a "model" to a Canadian bank supervisor, isn't one to a US bank supervisor, and is an "AI system" in the EU.

The retreat. In payments the rules only seemed to pile up. Here US agencies withdrew guidance in 2025 and 2026, and the liability moved to states, class actions and customers' contracts.

The certificate. In cloud security a SOC 2 report answered most of a buyer's questions. Here a lab's ISO certificate covers its own management system, and its customers get none of it by association.

The vendor in court. In AI coding agents the vendor's terms put the risk on the user. Here a court let job applicants pursue the HR software vendor directly, alongside the employers that used it.

Sources

Undated entries were read on October 9, 2026; "search result" means seen only as a search snippet or summary. Company figures are self-reported unless they come from a filing or a regulator. Analyst placements are as reported by the vendors, and vendor surveys cover the vendor's own respondents.

US bank regulators

Canada and the UK

EU AI Act

US federal agencies and preemption

US states and cities

Courts and settlements

Standards and certification

Surveys and research

Market, analysts and companies

Insurance

Reused from earlier guides on this site

Field Guides are learning notes, not legal or compliance advice. Rules and fees change; check the cited primary sources before you act on anything here.