Model risk management for generative AI is most useful when it follows the system through its lifecycle. A model card is one useful artifact, but it cannot describe every risk in a retrieval pipeline, an agent tool, a data feed, or the operational process around them.
Inventory the whole system
Start with a system inventory that names the business owner, technical owner, intended use, user groups, data classes, model providers, connected tools, and deployment regions. Record the boundaries where an input can become a model prompt, where a model output can become a decision, and where a decision can change an external system.
Risk classification should follow potential impact and exposure. A summarization helper over public documentation has a different control profile from a clinical drafting assistant or an agent that can create transactions. The system context determines the review effort.
Attach evidence to each control
For each identified risk, write down the control, its owner, and the evidence that demonstrates it works. Examples include a test proving protected data is masked before inference, an access-control check for retrieval, a golden evaluation set for citation quality, or a policy test showing an agent cannot invoke an unauthorized write tool.
A control without a named owner and repeatable evidence is difficult to rely on during a release or an incident.
Keep evidence versioned with the system release. Record model and prompt versions, evaluation results, data-source snapshots, approval decisions, and known limitations. That creates a reproducible picture of what was reviewed and what changed later.
Govern change and runtime behavior
Changes to a model, prompt, retrieval corpus, tool schema, or operating region can alter risk. Route material changes through a defined review path. Re-run evaluations at the boundary they affect, and make rollback or disablement possible without waiting for a full platform rebuild.
Runtime monitoring should focus on system behavior: access denials, citation failures, fallback frequency, human overrides, unsafe tool attempts, latency, and cost. Avoid collecting sensitive prompt content by default. Use sampled, access-controlled traces with retention rules that match the data class.
Keep accountability operational
For every consequential workflow, define escalation ownership and the authority to pause it. Operators need a clear way to identify a run, inspect the evidence and decisions, and stop future side effects while an issue is investigated.
MRM becomes practical when it connects system inventory, impact-based review, versioned evidence, change control, and incident response. Those mechanisms let teams move quickly while keeping the behavior of production GenAI systems explainable and governable.