Risk · R-076 · Model Performance & Reliability
Model not fit for its intended purpose
A model is deployed without evidence that it performs well enough for the specific task, population and conditions in which it is used.
- Severity
- High
- Audience
- Board · Heads-of · Practitioner
- Frameworks
- Article 15 · MAP 3 · MEASURE 2 · Principle 3
- Responsible AI domain
- Lifecycle stage
- Reviewed
- 2026-11-10
What it is
Fitness for purpose is a claim about a particular use: this model, for this decision, on these people, to this standard. The risk is that the claim was never tested. A model can be excellent in general and unsuitable here, because the task differs from what it was built for, the required accuracy was never stated, or its errors fall where they do most harm. This is the root model risk; several entries in this category describe specific ways in which fitness fails.
How it happens
- A general-purpose model is adopted because it impressed in a demonstration.
- No acceptance criteria were set, so any result counts as a pass.
- Performance is measured on average and is poor for the cases that matter.
- The supplier's benchmark figures are taken as evidence for a different task.
Why it matters
Every decision the model supports inherits its inadequacy. For a regulated firm, using a model without evidence of its suitability is also a failure of model risk management in its own right.
Warning signs
- No document states what the model must achieve to be acceptable.
- Evaluation used data unlike the production population.
- Results are reported as a single headline figure.
- The business owner cannot say how often the model is wrong.
Who owns it
The business owner of the decision is accountable for using a suitable model. The model owner provides the evidence. Independent validation challenges it before approval.
In practice
A firm uses a general language model to extract figures from scanned pension transfer documents. It reads typed documents well and misreads handwritten ones, which make up a third of the volume and were absent from the trial. The same pattern generalises to any model selected on general reputation and not tested on the work it will do.
Mitigating controls
Primary controls
- Independent model validation Detective
- Independently tests performance for the specific task and population. A function independent of the developers tests each model's conceptual soundness, data, performance and limitations before approval and periodically afterwards, to a depth set by the model's tier.
- Pre-deployment testing and acceptance Preventive
- Sets acceptance criteria that must be met before release. Functional, safety, security and user tests defined in advance must pass, with results recorded, before an AI system is released.
Supporting controls
- Intended-use definition and use restrictions Directive
- States the purpose against which fitness is judged. The approved purpose, users, population and conditions of use of each AI system are stated precisely, and any use outside them requires reassessment before it begins.
- Staged rollout Preventive
- Limits exposure while fitness is confirmed in use. New AI systems and material changes are released first to a limited population under close monitoring, and extended only when defined criteria are met.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| EU AI Act | Article 15 | Accuracy, robustness and cybersecurity Appropriate accuracy for the intended purpose. |
| NIST AI Risk Management Framework (AI RMF 1.0) | MAP 3 | Capabilities, intended use, benefits and costs are understood Intended use and limits understood. |
| NIST AI Risk Management Framework (AI RMF 1.0) | MEASURE 2 | Systems are evaluated for trustworthy characteristics Evaluation of validity and reliability. |
| SS1/23: Model Risk Management Principles for Banks | Principle 3 | Model development, implementation and use Development and use standards. |
Sources
- EU AI Act: Regulation (EU) 2024/1689 European Union (EUR-Lex) · official text
- SS1/23: Model Risk Management Principles for Banks Bank of England PRA · official text
- NIST AI Risk Management Framework (AI RMF 1.0) NIST · framework
Related terms
How to cite
Axiom Verity (2026). Model not fit for its intended purpose. Reference Library, R-076. https://axiom-verity.com/risks/model-not-fit-for-purpose. Reviewed 2026-11-10.
Found an error or a better source? Report a correction.