Engineering, production, governance, cost, communication · insight-0283

Scale governance effort to the risk tier of each model

Situation
Every model, from an internal dashboard forecast to a credit decision engine, goes through the same three-month review.
Action
Classify models by impact (who is affected, reversibility, automation level, regulation) and define proportionate requirements per tier: documentation, independent validation, fairness checks, monitoring and approval level.
Reason
Risk-management frameworks map context and risk before choosing measurements and controls, so effort goes where harm is possible.
Boundary
Organisations with many models or a model-risk function.

Symptom or risk

Uniform heavy review delays low-risk work and encourages teams to bypass governance, while high-risk models still get generic checks.

Regulated domains may prescribe minimum requirements regardless of internal tiering.

Tiering criteria can be gamed; review tier assignments periodically.

Assigning a tier once and not revisiting it when the model's use expands.

The NIST AI RMF structures AI risk management into Govern, Map, Measure and Manage functions.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)