SmartSuite for the Model Validator

Clear ownership assigns the model owner, business owner and independent reviewer to each model with documented responsibilities, so your separation from development is on the inventory and visible to anyone who checks.

Exception requests run through the same review workflow as approvals, with the condition recorded, so a model operating outside approved scope is a tracked exception rather than an unwritten understanding.

Connected model context shows the business processes, applications and datasets a model relies on, so you assess conceptual soundness and intended use against what the model actually touches rather than what the documentation says.

Each issue you raise links to the Model Owner, the mitigation, a deadline and the evidence of resolution, so a remediation condition is a tracked item on their list and a visible one on yours.

Early risk detection surfaces emerging risks from tracked indicators before they become regulatory or operational incidents, so the AI Risk Officer and you discuss a trend while it is still a trend.

Testing artifacts, review logs and supporting evidence are stored centrally against each model, so when the Internal Auditor samples a validation they read the file you built rather than a summary you write for them.

Audit trails and version history keep full records of each validation decision, the reviewer and the rationale over time, so an examiner reconstructing an approval finds the reasoning you recorded at the time.

Framework and regulatory alignment links models and assessments to laws, regulations and frameworks, so the conformity assessment the EU AI Act requires for a high-risk system is traceable to the requirement it satisfies.

Governance coverage tracking records the approved scope, controls and monitoring cycles for each model, so use outside the approved scope is a visible gap on the record rather than something discovered in outcomes analysis.

Model Risk Manager

The Model Validator provides independent oversight of AI risk and performance assessments and decides whether a model is approved, conditionally approved or canceled. They monitor drift, bias, safety, security and compliance indicators, review the issues raised against models and set remediation conditions, confirm that remediation is completed and effective, and document every validation decision with traceable evidence. Independence is the point: the validator was not involved in the model's development, as SR 26-2 and the PRA's SS1/23 require.

AI Governance runs assessment workflows with reviewer decision logs and exception tracking, so governance decisions are consistent and traceable. The validator reviews the Model Owner's assessment in the workflow, records the decision and its reasoning in the decision log, and logs any exception granted with its conditions. CRI AI RMF supplies the assessment structure where that profile is used. A later reviewer, or the Internal Auditor, can see why a model was approved and on what conditions.

SmartSuite monitors key AI risk and performance indicators such as drift, bias, safety and security signals against each model, so the Model Validator sees when an indicator moves outside what the approval assumed and can raise an issue or revisit the conditions. The AI Risk Officer sees the same indicators for the risk view. Monitoring is part of the model's record, which is the ongoing monitoring that NIST AI RMF's Measure function and SR 26-2 expect.

Remediation actions are completed and validated in Issues Management before approval conditions are lifted, so a condition attached to a conditional approval stays open until the Model Owner has submitted evidence and the validator has confirmed it. The validator does not take a status update on trust; the evidence is on the issue, and the condition is lifted in the record. That sequence is what makes a conditional approval enforceable rather than advisory.

SmartSuite records approval outcomes and open conditions for governance reporting, so the Model Risk Manager sees each validation's decision, the conditions attached and which remain open without asking for a summary. The AI Governance Lead has the same view for governance meetings. Because the decision log and the conditions are the record, the report upward is a filter on it, and the evidence behind any decision is one step away.

A validator needs the models they are assigned to review, with their owners and the assessments due, and the criteria they apply when deciding approval. New customers can start with SmartSuite Onboarding, a guided four-week program around one or two priority workflows; for a validation team the first workflow is the assessment review with its decision log. Decisions, conditions and exceptions from previous validations can be recorded so the history is complete, and from then on each model carries its decision log, which is what a regulator or auditor asks to see.