The 2026 Mandate: Why Model Risk Management Is Now a Strategic Imperative
Underneath those numbers, net interest income plateaued. Customer satisfaction dipped despite continued investment in digital. Regulatory pressure increased. And AI expectations from boards went through the roof.
It is no longer "show us what AI can do." It is "show us the impact. Show us the governance. Show us the controls." For model risk practitioners, that conversation is now yours to lead.
The Pilot Era Is Over
According to McElroy, in 2024 and 2025 banks saw an explosion of AI projects. Pilots, proof of concepts, GenAI experiments, innovation labs. A lot of energy, a lot of demos, and very few made it to production.
That is changing. Boards and regulators are saying show me the impact, show me the governance, show me the controls. And the answer most banks keep running into is not that the models were bad. As McElroy put it, most of the time the answer is not the model. It is the data.
McElroy was direct about what mature AI actually requires: trusted and governed data, model risk management and explainability, enterprise orchestration rather than isolated models, and controls and accountability across risk, compliance, and business lines.
"Banks no longer want 200 models. They need 200 governed decisions that are explainable." That distinction is worth sitting with.
So What Does Getting It Right Actually Look Like
McElroy laid out three things banks need to prioritize in 2026.
1. Fix the foundation first.
The foundation does not have to be perfect, but it does have to be trusted, governed, and explainable. McElroy specifically called out weak data lineage and missing transparency, inconsistent quality creating inconsistent decisions, and fragmented systems that slow down everything from risk to onboarding.
Every model needs a documented home. The objective of model inventory management in SAS Model Risk Management is to record, track, and report information about models over the course of the model life cycle. That includes assessing candidacy, categorizing the model, assigning stakeholders, providing documentation, linking to data sources, and maintaining a history of model changes. Each model is represented as an object within the inventory, containing metadata and details about its relationships with other relevant business objects.
Without that structure, the question "what models are involved in this decision" does not have a fast answer.
2. Get governance into the workflow, not around it.
McElroy was clear that mature AI requires controls and accountability across risk, compliance, and business lines. Governance comes first. Outcomes come first. Orchestration comes first.
The Findings object in SAS Model Risk Management is defined as weaknesses or shortcomings identified during a model review or validation, are documented and tracked through a structured workflow. Each finding progresses through distinct stages that ensure accountability and provide a clear record for auditing and reporting. Action plans, which outline specific steps to mitigate or resolve issues, are integrated with findings and tracked through the same system.
That is what turns a model deployment into a defensible, governed decision.
3. Treat oversight as ongoing, not one-time.
Model monitoring is a core element of ongoing model governance. It supports the ongoing use of both new and existing models by evaluating model performance over time to ensure that models continue to operate within defined expectations.
During model performance reviews, KPI values generated outside the application are compared against defined thresholds in associated model evaluation plans. Depending on configuration, threshold breaches can result in findings, connecting monitoring directly back into the governance workflow.
For more information on model performance monitoring, check out this blog post, From Goal to Governance: How Quantum Bancorp Strengthened Its Fraud Detection Model Using SAS Model ....
Explainability Has to Be Built In
This runs through all three priorities. McElroy named explainability as a core requirement for mature AI, alongside governance and accountability.
In SAS Model Risk Management, explainability is a structured part of the production monitoring process. During a model performance review, users select an explainability rating and can enter comments on explainability directly in the platform. It is not something constructed after the fact. It is captured as part of the model's record, alongside performance and fairness, every time a review is conducted.
When an examiner asks for documentation, the answer should already exist in the record.
The Bottom Line
McElroy summed it up plainly. Banks are entering 2026 under pressure to make sharper, faster, and better-governed decisions. AI governance gaps that stall progress beyond the pilot phase are one of the specific barriers she named. So are siloed data, missing transparency, and the absence of enterprise orchestration.
The banks that will lead are not the ones with the most models. They are the ones with the most accountable ones.
For more information on SAS Model Risk Management, click here.
For more articles on SAS Model Risk Management, click here.
Find more articles from SAS Global Enablement and Learning here.
