The House Financial Services Committee is asking a critical question: how should federal law govern AI in financial services? If you're waiting for a comprehensive answer before you act, you're building on sand. The Center for Democracy and Technology highlights gaps in current oversight: model fairness, explainability, risk management, third-party liability, and data privacy limitations. These aren't abstract policy concerns. They're operational gaps your compliance program needs to close now.
Here's how to build a financial AI compliance program that'll hold up under today's patchwork regulation and tomorrow's federal framework.
The Problem: You're Operating in a Regulatory Gap
Financial institutions deploying AI face a contradiction. SR 11-7 gives you model risk management requirements, but it predates large language models and doesn't address fairness testing for protected classes. GDPR applies if you touch EU data, but it doesn't map cleanly to credit decisioning or fraud detection systems. The Equal Credit Opportunity Act prohibits discrimination, but regulators haven't published technical guidance on how to validate fairness in ensemble models or neural networks.
You're accountable under existing law, but the playbook doesn't exist yet. That's the gap you need to fill.
What You Need Before Starting
Regulatory baseline documentation:
- Your institution's current SR 11-7 model inventory and validation procedures
- Copies of any vendor AI contracts, including liability and indemnification clauses
- List of AI systems that touch protected class data (race, gender, age, disability status)
- Data flow maps showing where personal financial data enters and exits AI systems
Technical access:
- Model development environments with version control
- Production model monitoring dashboards
- Access to training data and feature engineering pipelines
- Vendor technical documentation for any outsourced models
Team alignment:
- Model risk manager who understands both SR 11-7 and AI-specific risks
- Legal counsel familiar with fair lending and consumer protection law
- Data scientist who can implement fairness testing
- Third-party risk manager with vendor oversight authority
If you don't have all of these, start with what you have. You can build iteratively, but you can't start without at least basic model inventory and legal review capacity.
Step-by-Step Implementation
1. Extend Your Model Inventory for AI-Specific Risks
Open your SR 11-7 model inventory. For each AI system, add four columns:
- Protected class exposure: Does this model use or predict outcomes related to race, gender, age, national origin, disability, or familial status?
- Explainability method: Can you produce reason codes for individual decisions? If not, document why and what compensating controls you've implemented.
- Third-party components: Which parts of this system come from vendors? Foundation models, feature stores, monitoring tools?
- Data lineage: Where does training data originate, and how do you verify its quality and representativeness?
This isn't make-work. When regulators ask how you manage AI risk, this inventory is your first line of defense.
2. Build Fairness Testing into Model Validation
SR 11-7 requires independent validation. Extend your validation protocol to include fairness metrics:
For classification models (fraud detection, credit approval):
- Calculate demographic parity: approval rates across protected classes
- Measure equalized odds: false positive and false negative rates by group
- Test for disparate impact under the 80% rule
For regression models (credit scoring, loan pricing):
- Compare mean predictions across demographic groups
- Test for calibration: do predicted probabilities match actual outcomes within each group?
- Measure residual analysis for systematic over- or under-prediction by protected class
Document your fairness testing in the validation report. If you find disparities, don't just note them. Explain whether they're legally justifiable (based on legitimate risk factors) or require bias mitigation.
3. Map Third-Party Liability and Control Gaps
List every vendor providing AI components: foundation model providers, data brokers, model monitoring platforms, feature engineering services. For each vendor, answer:
- Liability allocation: If this vendor's model produces a discriminatory outcome, who's legally responsible? Your contract should be explicit.
- Validation access: Can you independently validate the vendor's model, or are you relying on their attestation?
- Incident response: If the vendor's model fails or drifts, how quickly can you disable it? Do you have a fallback?
- Data handling: Does the vendor process personal financial data? Under what terms? Have you conducted vendor due diligence on their data security?
If your contract doesn't give you validation access or clear liability terms, you're carrying unmanaged risk. Renegotiate or plan to exit.
4. Implement Explainability Controls
For high-stakes decisions (credit, pricing, fraud), you need to explain outcomes to consumers. If you're using complex models, pick an explainability approach:
- LIME or SHAP: Post-hoc explanations that approximate model behavior locally
- Rule extraction: Distill the model into interpretable decision rules
- Reason codes: Identify the top factors driving each decision
Test your explanations. Can a compliance officer understand them? Can a consumer challenge them? If not, your explainability control isn't working.
5. Set Up Post-Market Monitoring for Drift and Fairness
Don't wait for annual validation. Implement continuous monitoring:
- Performance drift: Track prediction accuracy, precision, and recall weekly
- Fairness drift: Recalculate demographic parity and equalized odds monthly
- Data drift: Monitor feature distributions for shifts that might indicate training-serving skew
Set thresholds. If fairness metrics degrade beyond a defined limit, trigger a review. If performance drops below your validation baseline, halt the model and investigate.
Validation: How to Verify It Works
Run a tabletop exercise. Pick one AI system and walk through a regulatory exam:
- Can you produce the model inventory entry in under five minutes?
- Can you show validation evidence, including fairness testing results?
- Can you explain the vendor's role and your contractual protections?
- Can you demonstrate that monitoring is active and that you've acted on alerts?
If you can't answer these questions with documentation, your program has gaps.
Maintenance and Ongoing Tasks
Quarterly:
- Review monitoring dashboards for drift or fairness degradation
- Update model inventory for new AI deployments
- Audit vendor compliance with contractual obligations
Annually:
- Revalidate all material models, including updated fairness testing
- Review third-party contracts for changes in liability or service terms
- Train compliance and risk teams on new AI regulatory developments
When the federal framework arrives:
- Map your existing controls to new requirements
- Identify gaps and build a remediation plan
- Update vendor contracts to reflect new liability standards
You're not building this program in a vacuum. The CDT submission to the House Financial Services Committee highlights model fairness, explainability, and risk management as regulatory priorities. Your program should already address these areas. When Congress acts, you'll adapt, not rebuild.
Start with your model inventory. Extend your validation process. Lock down your vendor risks. The regulatory framework is coming, but the compliance work starts now.
