# Fed SR 11-7 / UK PRA SS1/23

US Federal Reserve **SR 11-7** (Supervisory Guidance on Model Risk Management, 2011) and UK PRA **SS1/23** (Model risk management principles for banks, 2023) are the two dominant model-risk regimes for banks deploying AI/ML. Both share the same three-pillar structure: **model development**, **validation**, **governance**.

## SR 11-7 — Edge contribution by pillar

### Pillar 1 — Model development, implementation, use

| Expectation                                                    | Edge contribution                                         |
| -------------------------------------------------------------- | --------------------------------------------------------- |
| Model documentation that a third party could re-implement from | Per-release model card (planned Gate 19) + this docs site |
| Inputs documented and source-controlled                        | Golden dataset schema; item-level versioning              |
| Limitations articulated                                        | Per-use-case metric averages reveal weakness profile      |
| Use-case fit testing                                           | Per use case default metrics (RAG, QA, Directives, etc.)  |

### Pillar 2 — Model validation

This is where Edge is most directly relevant.

| Expectation                                      | Edge contribution                                                         |
| ------------------------------------------------ | ------------------------------------------------------------------------- |
| **Effective challenge** by independent reviewers | Annotation Studio + Golden Review enable an independent reviewer workflow |
| **Outcome analysis**                             | 24 metrics, per-item drilldown, AI report narrative                       |
| **Benchmarking**                                 | Same flow runs against different LLMs; results comparable in Langfuse     |
| **Ongoing monitoring**                           | Scheduled flows + score trend tracking                                    |
| **Documentation of validation findings**         | `ai_reports` collection; exportable to PDF for the regulator              |

### Pillar 3 — Governance, policies, controls

| Expectation                     | Edge contribution                                                                                   |
| ------------------------------- | --------------------------------------------------------------------------------------------------- |
| Model inventory                 | `models` schema in PocketBase (per workspace)                                                       |
| Roles and responsibilities      | RBAC + workspace isolation; CODEOWNERS for the platform                                             |
| Internal audit trail            | `admin_actions` append-only log                                                                     |
| Independent validation function | Workspace separation lets validators run on the same goldens without write access to dev workspaces |
| Issue management                | Incident response runbook; severity ladder                                                          |

## UK PRA SS1/23 — additions and emphasis

SS1/23 builds on SR 11-7 with explicit AI/ML emphasis. Specific to Edge:

| SS1/23 principle                                                      | Edge contribution                                                           |
| --------------------------------------------------------------------- | --------------------------------------------------------------------------- |
| **3.1** Model identification (incl. AI components)                    | Workspace-scoped model registry                                             |
| **3.4** Continuous monitoring of AI models                            | Scheduled flows; online-capable metrics on prod traffic                     |
| **4.2** Independent validation, frequency proportional to materiality | Independent workspace for validators; frequency controlled by cron schedule |
| **5.2** Issue management, evidence of remediation                     | `admin_actions` + post-mortem template                                      |
| **5.3** Risk culture, training                                        | Out of scope (deployer responsibility)                                      |

## What the validator does in Edge

```mermaid
flowchart LR
    Dev[Dev workspace<br/>builds model] -->|tags release| Model[Model artefact]
    Validator[Independent workspace<br/>read-only on dev data] -->|runs evals| Eval[Edge flow]
    Eval -->|scores| Report[Validation report]
    Report -->|exports| Reg[Regulator-ready PDF]
    Issues[Issues found] -->|filed in| Inc[Incident channel]
    Inc -->|remediated| Dev
```

## Evidence package for a model risk review

When a model risk team asks for the Edge-side evidence:

1. Export `evaluation_runs` for the period under review (CSV / SQL).
2. Export `ai_reports` for the model versions covered.
3. Export `admin_actions` filtered to the relevant workspaces.
4. Snapshot the golden datasets (frozen items, signed).
5. Bundle with the release notes from `edge-app` for the model versions used.

Today this is a manual export. A future Gate (Phase 2) will package it as a CLI: `edge audit-pack --model=<id> --period=<from..to>`.

## What Edge does **not** do

* Edge does **not** assign a materiality rating to a model. The bank's model risk committee does.
* Edge does **not** replace the second-line validation function — it tools it.
* Edge does **not** certify SR 11-7 / SS1/23 compliance. It produces evidence; the bank's auditor concludes.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.edge.nyami.fr/compliance/fed-sr-11-7.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.