SR 26-2 and generative AI: what banks still need

On 17 April 2026 the Federal Reserve, the Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) issued one revised piece of guidance on model risk management, each under its own reference. For the Federal Reserve it is SR 26-2, which “supersedes and replaces” SR 11-7, the model risk letter banks have worked to since April 2011, and SR 21-8, the 2021 statement on models used for Bank Secrecy Act and anti-money laundering compliance [1]. The OCC and the FDIC withdrew their own versions of the old guidance on the same day [3, 5].

Three things about it matter before you get to AI. It is tailored: the agencies expect it to be most relevant to banking organisations with more than $30 billion in total assets, though it may also be relevant to smaller ones with significant exposure to model risk [2]. It is guidance rather than a rule: it “does not set forth enforceable standards or prescriptive requirements”, and not following it will not bring supervisory criticism, although a footnote keeps supervisory action open for violations of law or unsafe or unsound practices that come from managing model risk badly [2]. And it sets the effort by materiality, meaning how much a model’s output matters to the business and what the model is for, with more rigour for the models that matter most [2].

The AI exclusion sits in footnote 3, attached to the guidance’s definition of a model: “a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates” [2]. The footnote reads, in full: “Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance. Nonetheless, a banking organization’s risk management and governance practices should guide the determination of appropriate governance and controls for any tools, processes, or systems not covered in this document. However, the principles described in this guidance apply to traditional statistical and quantitative models and non-generative, non-agentic AI models.” [2]

Stop after the second sentence and it reads like a free pass. The third sentence says the opposite. The agencies have not said a bank’s chatbots and agents need no controls. They have said the model risk framework is the wrong vehicle for them, for now, and that the bank’s own risk management has to decide what the controls are. I think that is a harder job than the one it replaces, because nobody has handed you the template.

Two weeks later the Federal Reserve’s Vice Chair for Supervision, Michelle W. Bowman, described the revised guidance as one that “now applies narrowly to traditional models and basic AI applications”, and added: “Going forward, we expect other risk-management and governance practices to support adoption of generative and agentic AI in ways that will encourage ongoing innovation.” [6]

The agencies also said they plan to issue, “in the near future”, a request for information on model risk management that considers banks’ use of AI, including generative and agentic AI [3, 4]. When I searched the Federal Register on 29 September 2026, it had not been published.

If the bank’s own risk management now sets the controls, the quickest defensible route is to borrow the structure SR 26-2 uses for the models it does cover and adapt each part to what a language model is. Examiners and internal audit already know that structure, so a control set built on it takes less explaining. The table below does that part by part. The middle column says where each idea comes from, so nobody mistakes it for a requirement SR 26-2 places on generative AI. A bank whose holding company reports to the SEC has one more set of controls to meet wherever a language model touches financial reporting, and our guide to SOX controls for AI in the finance close sets those out.

Not every system needs all nine at full weight. An internal assistant that drafts text a person reads and rewrites sits low on both materiality questions, and needs the register, the purpose statement, approved access and a light sample. An agent that can change a customer record needs everything in the table before it runs. The effort should follow the tier, which is the same tailoring SR 26-2 asks for in the models it does cover [2]. Whether a workflow needs an agent at all is worth settling first, and our guide to AI agents for business sets out where agents fit and where a simpler workflow does the job.

This is a design built from published principles. It is not a statement of what any agency requires for generative AI, and it is not legal advice: whether it is enough for your institution is a question for your model risk function, your compliance team and your counsel.

SR 26-2 describes validation in three parts: conceptual soundness, outcomes analysis and ongoing monitoring [2]. For a scorecard, all three can start from the model itself. For a language model bought from a vendor, conceptual soundness mostly cannot. You will not get the weights or the training data, and nobody inside the bank can review the design of a frontier model the way a validator reviews a regression. The guidance already anticipates the vendor half of that problem: it notes that a bank may not receive a vendor’s code, data or methodology, and says the principles of model risk management still apply [2].

So the validation moves to the system around the model: the prompt, the retrieval, the tools and the rules that decide what an output is allowed to do. Those are the parts the bank wrote, can change and can test. Outcomes analysis carries most of the weight. The guidance says that where a model’s design relies heavily on expert judgement, quantitative outcomes analysis helps to evaluate the quality of that judgement [2], and a language model is, in effect, a judgement engine somebody else trained.

The closest published work of ours is not in a bank, but the method carries over. On a finance data connector, connecting the data took an afternoon, and the week after went on checking the agent’s answers against the finance director’s until the two agreed on the definitions the business uses (engagement file D-06). On a regulated speaking assessment, agreement with human examiners is a release gate in CI, and low-confidence cases go to a human examiner (engagement file D-02). Both are outcomes analysis under another name: the system is judged against people the business already trusts, before it ships and after.

The request for information the agencies promised in April is the one to watch. It is where they will show how they think about generative and agentic AI in banks, and answering it is a cheap way for a bank’s model risk team to be heard before anything firmer arrives.

On 15 September 2026 the OCC, the Federal Reserve, the FDIC and the National Credit Union Administration proposed third-party risk management guidance that would replace the 2023 interagency guidance, with comments due by 16 November 2026 [7]. The proposal does not mention AI. It still matters here, because a bank’s language model systems nearly always run on a vendor’s model, so it will shape the vendor row of the control set. Where the supplier building the system around that model has no SOC report to send, our guide to reviewing an AI supplier that has no SOC report sets out the evidence to ask for instead.

NIST says its AI Risk Management Framework is being revised as part of the White House AI Action Plan [8]. The framework is voluntary, but if your control set is mapped to it, expect to remap when the new version lands.

1AYM works in financial services, and building the controls in the table into the systems they govern is our AI governance implementation work, delivered as a fixed-scope architecture and production build. In practice that means the register kept as code, the evaluation suite running in CI, verifier gates on what an agent may do, and an audit trail those gates write as they run. Whether the result satisfies your examiners stays with your model risk function and your counsel. Our job is to make sure they have evidence to judge rather than a slide.

US clients can contract with 1AYM’s US entity. We hold no ISO or SOC certification today, so if your third-party process makes a SOC report a hard requirement, a first call is the cheapest place to find that out. Once a scope is signed, the build can start within a day. The call is booked from the end of this page.