The precedent everybody cites, and the footnote nobody reads
Model risk management is the answer financial services reaches for whenever the question of governing AI comes up. It is a reasonable instinct. Since 2011 the discipline has required that a model be challenged by people with the expertise, the independence and the standing to force a change, and no other industry has anything as developed.
On 17 April 2026 the Federal Reserve, the FDIC and the Office of the Comptroller of the Currency issued SR 26-2, replacing the 2011 framework after fifteen years of supervisory experience. Footnote 3 states that generative and agentic AI models are novel and rapidly evolving and are not within the scope of this guidance.
So the ready-made precedent declines the job, in writing, from the supervisors themselves. Anyone presenting model risk management to a board as the framework already covering generative AI is presenting a document that says otherwise on its first page of footnotes. The full entry, including what it does not prove, is in the evidence base.
Two honest qualifications belong with it. The same footnote directs firms to their own risk management and governance for tools outside scope, so nothing here says generative AI in banks is ungoverned. And it is United States banking supervision, and guidance rather than rule.
What effective challenge actually asks of a person
The concept SR 26-2 retains is the useful one, and it is more demanding than the compliance reading of it. Effective challenge is critical analysis by objective, informed parties who have expertise, independence and the organisational standing to force a change.
Three conditions, and only one of them is a governance question. Independence is structural and organisations are good at it. Standing is political and boards can grant it. Expertise is neither: it is built by doing the work, and it is the condition quietly eroding while the other two are being documented.
That is the whole argument of this keynote in an industry that already has the vocabulary for it. The people who can mount an effective challenge to a model are the people who once built models, priced risk, read the credit file or did the reserving by hand. The argument is set out at who supervises work they cannot do.
The profession whose job is verification did not measure it
Audit is the closest neighbour to this problem, and its regulator has looked. The Financial Reporting Council's thematic review of how the six largest UK audit firms certify automated tools, published 26 June 2025 on fieldwork through 2024, found that all six had a certification process and that maturity varied, in some cases unsupported by formal documented policies.
The counts are worth saying aloud to a room. Of six firms, two set out a tool's limitations or restrictions on its use in the certification documentation. One enforced a minimum recertification frequency. And the finding that carries furthest, in the FRC's own words: there was no formal monitoring performed by the firms to quantify the audit quality impact of using those tools.
The profession whose function is verification had deployed the tools producing its evidence without measuring their effect on the quality of that evidence. Stated fairly: the review measures process rather than outcome, covers only the six largest firms, and does not show that audit quality has fallen. It shows that nobody was checking whether it had.
What a session looks like for this audience
Boards and board risk committees, executive committees, model risk and validation functions, internal audit, chief risk officers and their teams, and the annual leadership conferences of banks, insurers and asset managers. It works as a keynote of 30 to 90 minutes or as a closed board session.
It is not a regulatory briefing and does not compete with counsel or the risk function. What it does is take one question a board can act on: which decisions in this institution require judgement that somebody here still has, and how would you know if that stopped being true. The board-level version of that is at what board oversight of AI looks like.
He is the wrong choice for a vendor showcase, a model governance training course or a technical briefing on machine learning. Where the fit is wrong you will be told, and sometimes pointed elsewhere.
The three keynotes, and which fits this room
Keynotes run 30 to 90 minutes, in person or virtual. A 30-minute main-stage version of each talk is available for conferences; the full argument needs 40 or more. The sector examples change for the room; the argument does not. All three, with the showreel, are at keynotes, and the programme copy is at the speaker pack.
Drift versus Design
Drift versus Design: why most organisations hand their judgement to AI without deciding to, and how to design your way through instead.
Most organisations are adopting AI by drift: a thousand reasonable decisions that add up to judgement nobody chose to give away. Rahim Hirji, author of SuperSkills, shows leaders which mode they are running, where AI sharpens judgement and where it weakens it, and hands them the controls.
We Are Superheroes
We Are Superheroes: AI is the suit. The human decides.
AI makes everyone faster, stronger and more capable. It does not decide; people do. Through a family story across four generations and three continents, Rahim Hirji hands the audience the seven human skills that grow more valuable as the tools spread. They arrive thinking AI is the story and leave knowing they are.
WTH (What the Human)
WTH (What the Human): a live test of a board's own judgement.
Business is being rewired as AI arrives, and human judgement is leaving with it. In three acts, Rahim Hirji shows a board what AI is changing in how organisations run, then ends with a live test of the board's own judgement, in the room and in real time. Nobody forgets the result.
