Different regulators, one sentence

Thirteen regulators and standards bodies, sorted by date, each quoted from its primary text on the same demand: prove what your model does. Statuses stated as they are.

A working note tracking the regulatory convergence behind the Prove door: thirteen instruments from 2011 to 2026, each one a different regulator or standards body arriving at the same requirement, to prove what a model does. Every quotation below is read from the issuing body's own document; where a document is a draft, a consultation, a proposed issue, or a paywalled standard, that status is stated alongside the quotation rather than smoothed over.

Federal Reserve and OCC, SR 11-7 / OCC 2011-12, Supervisory Guidance on Model Risk Management, April 2011. "Also, organizations should maintain an inventory of models implemented for use, under development for implementation, or recently retired." https://www.federalreserve.gov/supervisionreg/srletters/sr1107.htm

FDA, Health Canada, MHRA, Good Machine Learning Practice for Medical Device Development: Guiding Principles, October 2021. "Deployed models have the capability to be monitored in 'real world' use with a focus on maintained or improved safety and performance." Guiding principle 10; IMDRF issued a final GMLP document in January 2025 building on these. https://www.fda.gov/media/153486/download

Central Bank of the UAE, Model Management Standards, Notice 5052/2022, November 2022. "Institutions must maintain a comprehensive inventory of all their models employed in production to support decision-making." https://www.centralbank.ae/media/0oaarr3a/model-management-standards-attach-to-notice-5052-2022.pdf

NIST, AI Risk Management Framework 1.0 (NIST AI 100-1), January 2023. "Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities." https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf

Bank of England, PRA, SS1/23, Model risk management principles for banks, May 2023. "A comprehensive model inventory should be maintained to enable firms to: identify the sources of model risk; provide the management information needed for reporting model risk; and help to identify model inter-dependencies." May 2023 text; the supervisory statement was later amended, current version dated 23 April 2026. https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/supervisory-statement/2023/ss123.pdf

NAIC, Model Bulletin: Use of Artificial Intelligence Systems by Insurers, adopted 4 December 2023. "Regardless of the existence or scope of a written AIS Program, in the context of an investigation or market conduct action, an Insurer can expect to be asked about its development, deployment, and use of AI Systems." Model bulletin, as adopted by state insurance departments. https://content.naic.org/sites/default/files/inline-files/2023-12-4%20Model%20Bulletin_Adopted_0.pdf

ISO/IEC 42001:2023, December 2023. "ISO/IEC 42001 is an international standard that specifies requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS) within organizations." Publisher's abstract; the standard text itself is paywalled. https://www.iso.org/standard/42001

European Union, Regulation (EU) 2024/1689, the AI Act, June 2024 (OJ 12 July 2024). "High-risk AI systems shall be designed and developed in such a way as to ensure that their operation is sufficiently transparent to enable deployers to interpret a system's output and use it appropriately." https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng

ISO/PAS 8800:2024, Road vehicles, Safety and artificial intelligence, December 2024. "This document describes safety-related properties of AI systems that can be used to construct a convincing safety assurance claim for the absence of unreasonable risk." Publisher's abstract; the standard text itself is paywalled. https://www.iso.org/standard/83303.html

Monetary Authority of Singapore, Consultation Paper on Proposed Guidelines on AI Risk Management for Financial Institutions (P017-2025), November 2025. "MAS proposes that FIs establish and maintain an accurate and up-to-date inventory of AI use cases, systems or models to support governance and oversight, as well as risk management throughout the AI lifecycle." Consultation, closed 31 January 2026, no final guidelines yet. https://www.mas.gov.sg/publications/consultations/2025/consultation-paper-on-guidelines-on-artificial-intelligence-risk-management

Reserve Bank of India, Draft Guidance on Regulatory Principles for Model Risk Management, 2026, June 2026. "It should ensure that no model is used, relied upon, or deployed unless it is part of inventory." Draft, comments closed 24 July 2026, not yet final. https://www.rbi.org.in/Scripts/bs_viewcontent.aspx?Id=5089

EASA, Concept Paper: guidance for artificial intelligence applications, Proposed Issue 03, June 2026. "Explainability is a key property that any safety-related AI-based system should possess." Proposed Issue 03, under consultation; the last adopted issue is 02. https://www.easa.europa.eu/sites/default/files/dfu/easa_concept_paper_guidance_for_artificial_intelligence_applications_proposed_issue_03.pdf

Central Electricity Authority (India), Cyber Security in Power Sector Regulations, 2026, gazetted July 2026, in force 1 April 2027. "maintain asset register- (a) for all cyber assets along with the requisite details including ownership, hardware, firmware, software, and patch as per the procedure defined in Cyber Security Policy". Closest sentence; the regulations do not otherwise mention models. https://cea.nic.in/wp-content/uploads/notification/2026/08/Cyber_Regulations_Notification.pdf

The Key 4 AI. "Different regulators, one sentence." v0.2, 17 Sep 2026. The Key 4 AI. https://thekey4.ai/regulators/

Back to the library