--- title: What Boards Spend on AI Governance to Satisfy SR 11-7 Expectations in a Community Bank description: Explore how community banks can effectively budget for AI governance to meet SR 11-7 requirements and avoid regulatory pitfalls in their operations. image: https://blog.fivenines.com/hubfs/blog/taya-migration/1-sr-11-7-ai-governance-cost-ceo.docx.png --- [Skip to the main content.](https://blog.fivenines.com/what-boards-spend-on-ai-governance-to-satisfy-sr-11-7-expectations-in-a-community-bank#main-content) 1-855-817-5959    [help@fivenines.com](mailto:help@fivenines.com) [![FN\_Reverse\_Logo](https://blog.fivenines.com/hs-fs/hubfs/FN_Reverse_Logo.png?width=3022&height=849&name=FN_Reverse_Logo.png "FN_Reverse_Logo")](https://fivenines.com/) [![FiveNinesPrimaryLogo](https://blog.fivenines.com/hs-fs/hubfs/FiveNinesPrimaryLogo.png?width=3022&height=849&name=FiveNinesPrimaryLogo.png "FiveNinesPrimaryLogo")](https://fivenines.com/) - [Solutions](https://fivenines.com/solutions/) - [Managed IT Services](https://fivenines.com/solutions/managed-it-services/) - [Cybersecurity Services](https://fivenines.com/solutions/cybersecurity/) - [Cloud & Productivity](https://fivenines.com/solutions/cloud-productivity/) - [Projects & Enhancements](https://fivenines.com/solutions/it-projects/) - [Placement Services](https://fivenines.com/solutions/onsite-it/) - Industries - [Finance & Banking](https://fivenines.com/industries/banking/) - [Healthcare](https://fivenines.com/industries/healthcare/) - [Legal](https://fivenines.com/industries/legal/) - [Nonprofit](https://fivenines.com/industries/non-profit/) - [Manufacturing & Logistics](https://fivenines.com/industries/manufacturing-logistics/) - [Small & Mid-Sized Businesses](https://fivenines.com/industries/smb/) - [Insights](https://fivenines.com/resources/) - [Resource Library](https://fivenines.com/resources/) - [Blog](https://blog.fivenines.com) - [About](https://fivenines.com/about/) - [About Five Nines](https://fivenines.com/about/) - [Leadership Team](https://fivenines.com/our-team/) - [Community Impact](https://fivenines.com/community/) - [Partnerships](https://fivenines.com/partnerships/) - [Careers](https://fivenines.com/careers/) - [Company News](https://fivenines.com/news/) Let's Talk Get Support Toggle Menu Toggle Menu Let's Talk Get Support - [Solutions](https://fivenines.com/solutions/) - [Managed IT Services](https://fivenines.com/solutions/managed-it-services/) - [Cybersecurity Services](https://fivenines.com/solutions/cybersecurity/) - [Cloud & Productivity](https://fivenines.com/solutions/cloud-productivity/) - [Projects & Enhancements](https://fivenines.com/solutions/it-projects/) - [Placement Services](https://fivenines.com/solutions/onsite-it/) - Industries - [Finance & Banking](https://fivenines.com/industries/banking/) - [Healthcare](https://fivenines.com/industries/healthcare/) - [Legal](https://fivenines.com/industries/legal/) - [Nonprofit](https://fivenines.com/industries/non-profit/) - [Manufacturing & Logistics](https://fivenines.com/industries/manufacturing-logistics/) - [Small & Mid-Sized Businesses](https://fivenines.com/industries/smb/) - [Insights](https://fivenines.com/resources/) - [Resource Library](https://fivenines.com/resources/) - [Blog](https://blog.fivenines.com) - [About](https://fivenines.com/about/) - [About Five Nines](https://fivenines.com/about/) - [Leadership Team](https://fivenines.com/our-team/) - [Community Impact](https://fivenines.com/community/) - [Partnerships](https://fivenines.com/partnerships/) - [Careers](https://fivenines.com/careers/) - [Company News](https://fivenines.com/news/) # What Boards Spend on AI Governance to Satisfy SR 11-7 Expectations in a Community Bank [Five Nines Executive Team](https://blog.fivenines.com/author/five-nines-executive-team) : Oct 26, 2026, 6:00:00 AM 5 min read [Tech Operations Insights](https://blog.fivenines.com/topic/tech-operations-insights) ![What Boards Spend on AI Governance to Satisfy SR 11-7 Expectations in a Community Bank](https://blog.fivenines.com/hubfs/blog/taya-migration/1-sr-11-7-ai-governance-cost-ceo.docx.png) *TL;DR* - SR 11-7 does not assign a dollar figure to model risk management. It assigns a program. The cost of that program at a community bank scales with how many AI/ML models the bank operates and how much of the validation, documentation, and governance burden the bank has to build versus reuse. - The recurring annual cost of a defensible AI governance program at a community bank under $1B AUM sits in a recognizable range. Lower for banks with two or three AI models, vendor-supplied with strong attestations, and clean third-party oversight. Higher for banks with internal AI builds, AML or fraud models that retrain, or multiple AI lending models in the credit stack. - The CEO question is not what AI governance costs. It is whether the bank is spending enough to clear SR 11-7 plus the FFIEC AI/ML expectations the examiners now bring to the exam. A bank that under-invests does not save money. It accelerates the timeline to an MRA finding. ## What Community Banks Actually Spend on AI Governance A community bank CEO sitting in front of a budget proposal that includes a line for AI governance has a fair question. What does the rest of the industry actually spend on this, and is the number on the table reasonable for a bank our size? The question is harder to answer than it should be. SR 11-7 is the interagency framework that has governed model risk for over a decade, and it does not name a dollar figure. The FFIEC's 2021 AI/ML RFI and the OCC's third-party guidance both expect a program that is "commensurate with the materiality and complexity of model use," which is a sound principle but not a number a CEO can put in the budget. What follows is the plain-English version of what SR 11-7 requires of an AI program, the recurring cost components a CEO should expect to see, and the realistic range a community bank in the $250M to $1B AUM band actually spends.   ## What SR 11-7 Requires From a Community Bank SR 11-7, OCC Bulletin 2011-12, and the FDIC's adoption of the same framework establish three things a community bank must operate. The first is a model inventory. Every quantitative model used in a decision that affects the bank's safety, soundness, or consumer outcomes is listed, owned, classified by risk tier, and tracked through its lifecycle. AI and ML models are models for SR 11-7 purposes. So is any vendor-supplied scoring engine the bank uses in lending or fraud monitoring. The second is model validation. Every model in the inventory is validated by an independent party before deployment, with the depth and rigor of validation scaling with the model's risk tier. Validation is not a one-time event. Models that retrain, drift, or take on new data require ongoing monitoring and periodic revalidation. The third is effective challenge. Someone in the bank with the competence and the independence to push back on the model's owner reviews the model's design, performance, and assumptions. Effective challenge is the practice SR 11-7 names most prominently and the one examiners most frequently find deficient. For AI models, all three requirements apply with one wrinkle. AI models that retrain in production, or AI models that consume third-party data the bank does not control, require more validation effort than traditional statistical models because the inputs and outputs change over time. The cost reflects that.   ## The Five Cost Components of a Defensible AI Program A defensible AI governance program at a community bank has five recurring cost components. People. A qualified individual responsible for the model risk program, with enough seniority and bandwidth to actually do the work. At a community bank under $500M AUM, this is often a fraction of an existing role (the chief risk officer, the chief credit officer, or in some banks the chief compliance officer). At banks above $500M, dedicated staffing becomes more common. Total cost depends on whether the role is internal, shared with another function, or supplemented through a co-managed arrangement with a Tech-Operations partner. Validation work. Independent model validation, either by an internal team separate from the model owner, by an external validator, or by a partner that supplies the validation through a documented engagement. For a community bank with two to four AI models, annual validation runs in the low-to-mid five figures if engaged through a competent external partner. Banks doing it inadequately often spend less but produce documentation that examiners do not credit. Infrastructure. Documentation systems, model inventory tooling, evidence repositories, board-reporting templates. This is not a major capital expense at community bank scale, but it is not free. Banks that try to operate a model program out of email and a shared drive eventually produce examiner findings about documentation discipline. Vendor oversight. Time spent reviewing vendor model attestations, sending diligence questionnaires, attending vendor governance meetings, and maintaining the right-to-audit clauses OCC 2023-17 expects. This cost scales with the number of vendor-supplied AI capabilities in the bank's stack. A bank with one AI lending vendor and one AML vendor spends less here than a bank with five third-party AI capabilities across functions. Board reporting. Quarterly model risk reporting to the audit committee or the full board. Materials prepared, meetings attended, decisions documented. The board's time is the most expensive component on a per-hour basis. The bank's cost here is the staff time to prepare the materials, not the board's hourly compensation.   ## What the Program Actually Costs at Community Bank Scale A community bank in the $250M to $500M AUM range with two to four AI or ML models in production, vendor-supplied with reasonable attestations, can operate a defensible SR 11-7-aligned program at an annual run-rate that fits inside a mid-five-figure to low-six-figure range. The lower bound assumes the bank shares the model risk role across an existing function and engages an external partner for independent validation. The upper bound assumes the bank has dedicated model risk staffing and runs more extensive testing. A community bank in the $500M to $1B range with more AI exposure (AI in indirect auto, AI-assisted AML, AI in credit decisioning, plus the productivity AI in cloud platforms) operates a program at a low-six-figure to mid-six-figure annual run-rate. The increase comes from staffing, more validation work, and more vendor oversight surface area. Banks above $1B AUM often have full-time model risk management functions, internal validation capability, and a board-level risk committee that meets more frequently. The annual run-rate moves into seven figures. These are recurring program costs. They do not include the one-time spend to remediate a specific finding or to onboard a new model. A bank that has not invested in its model risk program in three or four years and is preparing for an exam should expect remediation spend that is multiple times the annual program cost. The cheapest version of SR 11-7 compliance is the version where the program never falls behind.   ## Why "Our AI Use Is Small" Doesn't Delay the Examiner Somewhere in the budget conversation, the CEO will hear a version of this argument. AI in our bank is still small. The risk is contained. We can wait to invest in a real model risk program until our AI use grows. That is a false choice for two reasons. The first is that the examiners are not waiting. The FFIEC's 2021 AI/ML RFI established the framework, and the exam cycles since have increasingly probed AI governance. Banks with even a single AI-assisted model in production face exam questions about how the model is governed. Banks without an answer produce findings. The second is that an AI governance program is not something a bank builds in six months ahead of an exam. The model inventory has to be accurate. The validation has to be documented. The board reporting has to have a track record. A bank that decides in Q3 that it needs an AI governance program by the Q4 exam is in remediation, not in compliance. The right framing is not whether the bank's AI footprint justifies a full program today. It is whether the bank has the foundation in place so that when the AI footprint grows, the program scales with it. The first framing produces a reactive bank. The second framing produces a defensible one.   ## Three Things to Have Before the Next Exam Cycle A community bank CEO should work through three things before the next exam cycle. The first is a current-state inventory of every AI or ML model in the bank's decision path, with risk tier, owner, vendor relationship, and validation status named. The second is a sized program proposal that maps to the bank's actual AI footprint, with the cost components broken out so the CFO and audit committee can see what they are funding. The third is a calendar discipline for ongoing validation, vendor reviews, and board reporting that produces the documentation examiners ask for. When this discipline is in place, the AI conversation with examiners is recognizably calmer than the alternative. The conversation moves from "explain your AI governance" to "review the program's most recent outputs," and the gap between those two postures is the gap between a finding and a routine confirmation.   ## Size the AI Governance Program to the Footprint You Have, Not the One You're Planning A community bank CEO reading SR 11-7 for the first time encounters a document that describes a program rather than a price. The bank that operates the program at a level commensurate with its AI footprint, documents what it operates, and demonstrates governance over what it documents will defend the next exam on its own terms. The bank that waits until AI gets bigger before investing in governance will discover that the examiner did not wait either. If your bank has not sized its AI governance program against its current AI footprint in the last twelve months, that is the conversation worth having with your Tech-Operations partner before the next exam cycle. Five Nines Technology Group is a Tech-Operations partner for community banks and credit unions. Translating regulatory frameworks into operating discipline at community bank scale is where our team focuses. ## Frequently asked questions Does SR 11-7 apply to vendor-supplied AI we do not control? Yes. The bank is responsible for the risk of every model in its decision path, including vendor-supplied AI. The interagency third-party guidance (OCC 2023-17 and equivalents at FRB and FDIC) makes this explicit. The bank cannot delegate its model risk obligation to the vendor. What is the difference between model validation and model monitoring? Validation is the structured, independent review of a model's design, data, performance, and assumptions, usually conducted at deployment and on a periodic cycle thereafter. Monitoring is the ongoing observation of the model's performance in production, watching for drift, degradation, or population changes. SR 11-7 expects both, and AI/ML models that retrain require more monitoring than traditional statistical models. Can a community bank under $500M operate without a dedicated model risk officer? Yes, if the role is clearly assigned to an existing executive with the competence, the independence from the model's owners, and the bandwidth to actually do the work. The role does not have to be dedicated. It has to be effective. Examiners look for the substance, not the title. What is the cheapest defensible version of an AI governance program? Vendor-supplied AI with strong attestations, validated annually by a competent external party, with documented board reporting and a quarterly review cadence. This works for banks with a small AI footprint and clean vendor relationships. It does not work for banks with internal AI builds or AI in fast-changing functions like fraud monitoring. How does this interact with the bank's IT and information security program? The model risk program and the information security program are related but distinct. SR 11-7 governs the model itself. The information security program governs the data, infrastructure, and access controls around the model. Both are evaluated at the exam. Both report to the board. What is the most common finding banks get on AI governance? Inadequate model inventory and inadequate effective challenge. Banks know their models exist but cannot produce a current, complete inventory. Banks have someone reviewing the model but cannot demonstrate that the reviewer has the independence and influence to push back. Both are documentation and discipline issues more than they are dollar issues. Does partner engagement model validation produce the same compliance posture as in-house validation? Yes, when the external partner validator has the competence and the independence the framework expects. SR 11-7 does not require validation to be in-house. It requires validation to be independent of the model's owners and to be substantively rigorous. A community bank Tech-Operations partner that has model validation as a documented capability often produces stronger validation than in-house staff who also build the models. ## Related Blog Posts ## Let's get in touch   [**(402) 817-2630**](tel:402-817-2630) [help@fivenines.com](mailto:help@fivenines.com) [Lincoln, NE](https://fivenines.com/contact/lincoln) [Omaha, NE](https://fivenines.com/contact/omaha) [Kearney, NE](https://fivenines.com/contact/kearney) [Central City, NE](https://fivenines.com/contact/central-city) [St. Louis, MO](https://fivenines.com/st-louis) ![cyberverify-1](https://blog.fivenines.com/hs-fs/hubfs/cyberverify-1.png?width=110&height=110&name=cyberverify-1.png)![aicpa](https://blog.fivenines.com/hs-fs/hubfs/aicpa.png?width=110&height=110&name=aicpa.png) ### Are we a good fit? [![Schedule Consultation](https://no-cache.hubspot.com/cta/default/1857420/interactive-196258273705.png)](https://blog.fivenines.com/hs/cta/wi/redirect?encryptedPayload=AVxigLKjYGAuryT5UK%2FRiyZhThQkebpQvmD4bOfz5UfJJ3TlmCuXc%2FNJ6aBI%2FVhH%2BJptVrvvEvZRWxS3HmMloZKSK5DD%2F6XDZJ3mAyXMrySTGLpLfrXcgMIpn%2B1uy6w6%2FjwZSeIelFRS3fGj9JWQlCMpehlvCaX1%2BXfjsf0ezP9hE9k8hC7N9k2Cl5lvqicaC8dPzGTUCQ%3D%3D&webInteractiveContentId=196258273705&portalId=1857420)   - [Privacy Policy](https://fivenines.com/privacy-policy/) - [HTML Sitemap](https://fivenines.com/html-sitemap/) © 2026 Five Nines Technology Group | 5617 Thompson Creek Blvd Lincoln, NE 68516 [Facebook](https://www.facebook.com/gonines)[Linkedin](https://www.linkedin.com/company/five-nines-technology-group/) [Blog](https://blog.gonines.com/?__hstc=143714730.45718742b0726c421d8592d7ea71f58b.1757514685996.1758029308186.1758134756251.4&__hssc=143714730.31.1758134756251&__hsfp=1745665186)   [Client Support](https://fivenines.com/client-login/) Return to top ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes. The bank is responsible for the risk of every model in its decision path, including vendor-supplied AI. The interagency third-party guidance (OCC 2023-17 and equivalents at FRB and FDIC) makes this explicit. The bank cannot delegate its model risk obligation to the vendor." }, "name" : "Does SR 11-7 apply to vendor-supplied AI we do not control?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Validation is the structured, independent review of a model's design, data, performance, and assumptions, usually conducted at deployment and on a periodic cycle thereafter. Monitoring is the ongoing observation of the model's performance in production, watching for drift, degradation, or population changes. SR 11-7 expects both, and AI/ML models that retrain require more monitoring than traditional statistical models." }, "name" : "What is the difference between model validation and model monitoring?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes, if the role is clearly assigned to an existing executive with the competence, the independence from the model's owners, and the bandwidth to actually do the work. The role does not have to be dedicated. It has to be effective. Examiners look for the substance, not the title." }, "name" : "Can a community bank under $500M operate without a dedicated model risk officer?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Vendor-supplied AI with strong attestations, validated annually by a competent external party, with documented board reporting and a quarterly review cadence. This works for banks with a small AI footprint and clean vendor relationships. It does not work for banks with internal AI builds or AI in fast-changing functions like fraud monitoring." }, "name" : "What is the cheapest defensible version of an AI governance program?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "The model risk program and the information security program are related but distinct. SR 11-7 governs the model itself. The information security program governs the data, infrastructure, and access controls around the model. Both are evaluated at the exam. Both report to the board." }, "name" : "How does this interact with the bank's IT and information security program?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Inadequate model inventory and inadequate effective challenge. Banks know their models exist but cannot produce a current, complete inventory. Banks have someone reviewing the model but cannot demonstrate that the reviewer has the independence and influence to push back. Both are documentation and discipline issues more than they are dollar issues." }, "name" : "What is the most common finding banks get on AI governance?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes, when the external partner validator has the competence and the independence the framework expects. SR 11-7 does not require validation to be in-house. It requires validation to be independent of the model's owners and to be substantively rigorous. A community bank Tech-Operations partner that has model validation as a documented capability often produces stronger validation than in-house staff who also build the models." }, "name" : "Does partner engagement model validation produce the same compliance posture as in-house validation?" } ] } ```