US Bank Model Risk Guidance Drops Generative AI, Leaving Testing Ownership Unclear

What SR 26-2 changes

The Federal Reserve, the Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) issued SR 26-2 on April 17, 2026. It replaces SR 11-7, which had been in place since 2011 and around which many model risk teams built their programs. According to Anaconda, the new version keeps most of the same shape and is most relevant to banking organizations with more than $30 billion in total assets.

A footnote places generative AI and agentic AI models outside the guidance because they are new and changing quickly. Anaconda says the agencies plan to ask the industry for input. For these systems, banks are pointed to their broader risk management and governance practices instead.

Obligations remain, ownership is unclear

The exclusion applies only to the model risk management guidance, according to Anaconda. Fair lending, consumer protection, third-party risk management, cybersecurity and recordkeeping obligations still apply to any AI system a bank deploys. The author writes that a bank deploying an AI assistant owns what that assistant says.

The concern is practical. When a system falls outside the formal process, Anaconda says, nobody clearly owns testing it. The company suggests risk and compliance leaders ask which of their AI systems sit outside the model inventory today, and who is checking them. It says insurers and asset managers face the same questions.

The post describes failures that look like ordinary business problems rather than hacks. Examples include:

• A customer assistant quotes a fee that is not in the disclosure.
• An internal copilot shows one customer's account details to a colleague who is not cleared to see them.
• A claims assistant says something is covered when it is not, or treats two nearly identical claims differently.
• An advisor tool recommends an unsuitable product or passes along information that was meant to stay behind a wall.

Anaconda stresses these are illustrations, not findings from its upcoming report.

The case for red teaming

Anaconda points to its Agent Incident Registry, which documents 529 agent incidents as of September 21, 2026. Of these, 109 involved no adversary at all, about one in five. According to the company, such failures occur when a system behaves as built in a situation nobody tested.

The author argues red teaming should sit at the center of AI governance in financial institutions, meaning testing a system the way the real world will use it before customers or examiners do. The approach of Enkrypt AI, which is part of the Anaconda offering, rests on four ideas:

• Test the whole customer experience, including the tools the AI can use and the data it can reach.
• Start from the institution's own obligations, since a claims assistant and an investment copilot fail differently.
• Apply pressure the way real people do, by rephrasing, pushing back and switching languages.
• Leave evidence a risk team can file, map to frameworks such as the NIST AI Risk Management Framework and the EU AI Act, and give to an auditor.

Report and EU timeline

This October, Anaconda is publishing research titled Too Big to Fail Safe: AI Risk in Financial Services, covering how AI holds up across banking, insurance and asset management. The company says its approach powers AI security and guardrails in the Anaconda Platform, with testing before release, adaptive red-teaming agents that go beyond a fixed list of attacks, and the same evidence carried into guardrails once a system is live. It says this runs inside the customer's own environment, so prompts and data stay within the security boundary.

The post also notes an EU deadline change. The Digital Omnibus, Regulation (EU) 2026/1744, entered into force on July 27, 2026 and moved the deadline for stand-alone high-risk AI systems under the EU AI Act from August 2, 2026 to December 2, 2027. Those systems include AI used to score individuals' creditworthiness and AI used for risk assessment and pricing in life and health insurance.

What it means for financial firms

Based on the source, the practical takeaway is that the exclusion does not reduce a bank's responsibilities. Firms deploying chatbots, copilots or agents still need a way to test them and to document the results, whether or not those systems appear in a model inventory. Anaconda's view is that independent, workflow-level testing tied to a firm's own obligations is one way to do that. As the post is written by a vendor that sells such testing, its recommendations reflect the company's own approach.