Will AI replace risk management jobs?
By Nick Jang, founder of MINERVA Studio ·
The short answer
AI is taking over parts of risk management, not the job. It already reads documents, flags transactions, drafts assessments and monitors models faster than people can. What it can’t do, and what regulators still require a named person to do, is own a risk, challenge a model independently, approve a decision and answer for it afterwards. Meanwhile AI itself has created new work: AI governance, AI model validation and AI vendor risk roles that barely existed five years ago.
What AI already does well in risk
A lot of risk work is reading, matching and checking, and that’s where AI is strongest:
- reading contracts, vendor questionnaires and policies to pull out the clauses that matter;
- screening transactions for fraud and money laundering, and ranking the alerts;
- drafting the first version of a risk assessment, a control description or a validation report;
- watching model performance and data drift around the clock;
- mapping a new regulation against existing controls to find the gaps.
Each of these used to take an analyst hours. Done well, AI turns them into minutes of review. That changes what a junior risk role looks like: less assembling, more checking and judging.
What it can’t do, and what regulators won’t let it do
Risk management rests on accountability, and accountability needs a person. Banking rules make that explicit.
- OSFI’s E-23 expects models, AI ones included, to be reviewed by people independent of whoever built them, and approved by someone with the authority to do it.
- The three lines of defence assume a first line that owns risk, a second line that challenges it and a third that audits both. A model can support each line; it can’t be one.
- When an examiner asks why a model was approved with an open finding, "the AI said it was fine" isn’t an answer anyone can give.
There’s also a deeper reason. AI is now one of the risks being managed. Someone has to decide whether a model is fit for use, whether a vendor’s AI can be trusted with customer data and whether an AI agent may take an action on its own. That someone can’t be the system under review.
The new roles AI has created
| Role | What it does |
|---|---|
| AI governance lead | Runs the AI policy, the inventory of AI systems and the approval process. |
| AI model validator | Independently tests machine-learning and generative models for accuracy, bias and robustness. |
| AI risk manager | Rates AI systems, sets controls and reports AI risk to senior management and the board. |
| AI vendor risk analyst | Assesses suppliers whose products contain AI, and the models inside them. |
| AI auditor | Audits AI controls in the third line, often with an AI-specific audit credential. |
Demand follows regulation. In Canada, OSFI’s E-23 takes effect on 1 May 2027 and covers every AI model at a federally regulated bank or insurer. The EU AI Act phases in obligations for high-risk AI systems. In the United States, O*NET flags financial risk specialists as a Bright Outlook occupation, expected to grow rapidly over 2025 to 2035.
Is risk management still a good career?
Yes, if the skills move with it. The parts of the job that are pure assembly are shrinking. The parts that need judgement, independence and a signature are growing, and there are more AI systems to apply them to every year. Model risk, third-party risk and AI governance are where that growth is clearest.
The skills that hold up:
- understanding how models and AI systems work well enough to challenge them;
- knowing the rules your institution answers to, such as E-23, B-10 and the EU AI Act;
- writing decisions down so someone else can check them later;
- using AI tools yourself, and knowing where they go wrong.
If you’re looking at credentials, see which AI governance certification fits which role.
Related questions
Can AI do risk management on its own?
No. AI can analyse, monitor and draft, but risk management needs people who own risks, challenge models independently and approve decisions. Banking regulators such as OSFI require that.
Will AI replace risk analysts?
It will change the job more than remove it. Routine reading and checking is being automated; judgement, independent review and accountability are growing, especially for AI systems themselves.
Is AI governance a good career?
Demand is growing with regulation such as OSFI E-23 and the EU AI Act, and the roles are new enough that practical experience counts heavily. It suits people from risk, compliance, audit, privacy and data science.
Is model risk management a good career?
Yes. Every AI model at a regulated bank is a model to inventory, validate and monitor, so model risk teams are taking on more work as AI spreads.
What skills do I need for an AI risk management job?
A working understanding of models and AI, knowledge of the relevant rules, clear written judgement, and enough hands-on use of AI tools to know their failure modes.
Sources
- OSFI — Guideline E-23, Model Risk Management (2027)
- OSFI and FCAC — Risk Report: AI Uses and Risks at Federally Regulated Financial Institutions
- O*NET OnLine — Bright Outlook: Financial Risk Specialists
- EUR-Lex — Regulation (EU) 2024/1689, the AI Act
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.