For Heads-of · Practitioner
PRA SS1/23
Also known as: SS1/23 · Model risk management principles for banks
The Prudential Regulation Authority's supervisory statement setting out five principles for model risk management at UK banks. It took effect on 17 May 2024, applies to AI and machine learning models as to any other model, and was amended in April 2026.
- PRA
- SS1/23
- model risk management
- UK banking
- financial services
- model validation
Scope and principles
SS1/23 applies directly to banks, building societies and PRA-designated investment firms with permission to use internal models for regulatory capital, and the PRA expects other firms to consider it proportionately. Its five principles: model identification and classification; governance; model development, implementation and use; independent model validation; and model risk mitigants.
Why it matters for AI
The PRA chose not to write separate AI rules. SS1/23 defines a model broadly enough to include AI and machine learning, and its principles require a board-approved model risk appetite, a model inventory, independent validation and named ownership. For a model the firm did not build, such as a general-purpose model reached through an API, validation becomes a test of the system in the firm's own use. The detail is in the model risk management entry.
The April 2026 amendment
The PRA's low-impact amendments of 23 April 2026 (LIAF01/26) clarified that SS1/23's expectations are not conditions for internal model approval, and brought the models internal-model firms use for stress testing under SS1/23. A firm citing the statement should cite the amended version. The register entries it most directly addresses are AI system lifecycle controls gap and AI model drift and degradation.
Sources
Related Terms
AI Inventory
A maintained register of every AI system, model and AI-enabled feature an organisation uses, builds or buys, with an owner, a purpose, a risk tier and a status for each. It is the first control in every AI governance framework because none of the others can be applied to a system nobody has listed.
Impact Tolerance
The maximum tolerable level of disruption to an important business service, set under the UK operational resilience regime. Applied to AI, it asks how long a firm can run without an AI component, or with one that is wrong, before customers or markets suffer intolerable harm.
Model Risk Management (MRM)
The discipline of identifying, measuring, controlling and reporting the risk that a model is wrong, misused or misunderstood, across its whole life from development to retirement. It predates AI by decades in banking, and it is the frame UK regulators have chosen for AI in financial services: the PRA's SS1/23 principles have applied to AI models as to any other since May 2024, and were amended in April 2026.
Risk Appetite
The level and types of risk an organisation is willing to accept in pursuit of its strategic objectives. Applied to AI, a single organisational posture is rarely enough: appetite has to be set separately across distinct risk dimensions and tiers of decision consequence.