SR 26-2 replaces SR 11-7 and leaves generative AI and agents out of scope

What SR 26-2 replaces and who issued it

SR 26-2, Revised Guidance on Model Risk Management, is supervisory guidance issued by the Federal Reserve, the Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) on April 17, 2026. It supersedes SR 11-7, the 2011 guidance the OCC issued as Bulletin 2011-12, and SR 21-8, the 2021 interagency statement on model risk management for Bank Secrecy Act and anti-money laundering systems.

Fiddler notes that the new text keeps the lifecycle structure of SR 11-7 but strips out most of the prescriptive detail and ties the rigor of each practice to model materiality. The Federal Reserve letter describes the guidance as emphasizing "a risk-based approach to model risk management that is tailored to a banking organization's model risk profile and the size and complexity of its operations".

The guidance also states that it "does not set forth enforceable standards or prescriptive requirements". Non-compliance with it will not draw supervisory criticism, though a footnote preserves supervisory action for "violations of law or unsafe or unsound practices stemming from insufficient management of model risk". The OCC issued the same text as Bulletin 2026-13 and rescinded Bulletin 2011-12 and the Model Risk Management booklet of the Comptroller's Handbook.

On applicability, the FDIC's letter states the guidance generally does not apply to institutions at or below $30 billion in total assets unless they have significant model risk exposure. The Federal Reserve letter says it is "expected to be most relevant to banking organizations with over $30 billion in total assets regulated by the Federal Reserve".

A narrower model definition and the footnote 3 carve-out

SR 26-2 defines a model as "a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates." It excludes simple arithmetic such as spreadsheet calculations and deterministic rule-based software without underlying statistical, economic or financial theories.

Footnote 3 then addresses AI directly. It says generative and agentic AI models are "novel and rapidly evolving" and "not within the scope of this guidance". It adds that a bank's own risk management and governance practices should guide the determination of controls for anything not covered, while the principles still apply to traditional statistical and quantitative models and non-generative, non-agentic AI models.

Fiddler gives two examples of the split. A gradient-boosted credit decision model remains in scope and is still expected to undergo effective challenge. A foundation-model customer-service agent or a document-summarization LLM application is out of scope by default.

Federal Reserve Vice Chair for Supervision Bowman said on May 1, 2026 that the guidance "now applies narrowly to traditional models and basic AI applications". OCC Bulletin 2026-13 says the agencies "plan to issue in the near future a request for information" on model risk management and banks' use of AI, including generative and agentic AI.

Core expectations and a changed validation approach

SR 26-2 organizes its expectations into lifecycle sections IV through VII and scales each by materiality instead of a fixed checklist. Under Section IV, a bank may limit testing for models with relatively less material impact or for less complex operations. Under Section V, validation covers conceptual soundness, ongoing monitoring of whether a model is "performing as expected", and outcomes analysis that compares model outputs to real-world outcomes, such as back-testing or outlier analysis.

Fiddler's comparison with SR 11-7 shows several shifts. The older guidance called for validation "at least annually but more frequently if warranted", while SR 26-2 sets no fixed validation cadence. SR 11-7 enumerated board and senior management duties and inventory fields. SR 26-2 asks instead for "clear roles and responsibilities with well-defined accountability" and an inventory holding "sufficient information to understand model risks".

According to Fiddler, existing inventories, documentation standards, validation reports and monitoring reports remain the right artifacts. What changes is the stated rationale for how much of each a given model receives.

What it means for banks using LLMs and agents

Fiddler's central argument is that an existing SR 11-7 program needs re-papering against the new text, not retirement. Because the guidance mandates no tier scheme, with model purpose and exposure setting materiality, each bank has to document its own tiers.

For generative AI and agents, Fiddler says the control decision moves to the bank's own AI governance program, starting with a registry and continuous monitoring. It also advises that the model risk policy and the AI governance policy carry a written boundary stating which systems each covers and who signs off when a system moves between them.

Fiddler also says a vendor model, including a vendor LLM, stays inside the bank's validation and monitoring responsibility even when the vendor withholds code, data or methodology. The bank should validate and monitor it itself or through an outside party.

The firm illustrates the risk of one-time review with a hypothetical customer-service agent that passes review in March. After a provider update in June, it starts quoting a retired fee waiver rule. Fiddler cites a study by Chen et al. that measured GPT-4's accuracy on a prime-number task falling from 84.0% to 51.1% between its March and June 2023 versions.