SR 26-2 left generative AI out. Here is how banks govern it now

On April 17, 2026, the Federal Reserve, the OCC and the FDIC issued SR 26-2, revised guidance on model risk management. It supersedes and replaces SR 11-7, the 2011 letter that shaped how a generation of bank model risk management teams validated, inventoried and documented models.

Most of the new guidance reads as a lighter, more tailored version of the old one. One footnote does something new. It takes generative AI and agentic AI out of scope.

That footnote does not hand the chatbot, the summarizer or the agent back to the business without a review. It tells the bank to govern them with its own risk management and governance practices. For a model risk team, that is harder, because now the bank has to define the standard itself.

What SR 26-2 changed from SR 11-7

The SR 26-2 cover letter says the revision reflects "supervisory experience and industry feedback accumulated over the past fifteen years." Six changes matter most for a team that also owns GenAI review.

SR 26-2 is also explicit about its own weight. It "does not set forth enforceable standards or prescriptive requirements; accordingly, non-compliance with this guidance will not result in supervisory criticism against a banking organization" (OCC Bulletin 2026-13). Its first footnote adds the limit: "supervisory action may result for any violations of law or unsafe or unsound practices stemming from insufficient management of model risk" (SR 26-2 attachment, footnote 1).

Less prescription does not mean less scrutiny. It means the bank carries more of the burden of showing its own approach works.

The footnote that excludes generative and agentic AI

Here is footnote 3 of the SR 26-2 attachment in full:

"Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance. Nonetheless, a banking organization's risk management and governance practices should guide the determination of appropriate governance and controls for any tools, processes, or systems not covered in this document. However, the principles described in this guidance apply to traditional statistical and quantitative models and non-generative, non-agentic AI models."

What it means. SR 26-2 does not set the bar for a GenAI customer service assistant or an agent that drafts adverse action letters. The agencies chose not to write principles for a technology they call "novel and rapidly evolving." The OCC bulletin says the agencies plan a request for information that "considers, in particular, banks' use of AI, including generative AI and agentic AI and AI-based models." Expect more to come.

What it does not mean. It does not mean GenAI is ungoverned. The footnote's third sentence points straight back at the bank's own risk management and governance practices. An examiner who finds a GenAI system running without controls can still ask whether that is an unsafe or unsound practice.

It also does not shrink the scope of the system you deploy. The footnote's last sentence keeps traditional statistical models and non-generative AI in scope. A fraud triage agent that calls a scoring model still has an in-scope model inside it. The agent wraps it. The model risk team now governs both halves of that system, under two different reference points.

What model risk teams still owe their board and examiners for GenAI

The footnote sends the bank back to its own playbook. In practice, the most defensible playbook is the one the bank already runs for traditional models, adapted to systems that produce language instead of a score.

A board that approved a GenAI launch, and an examiner who asks about it, will want the same five answers SR 26-2 describes for any in-scope model.

• Where are these systems, and who owns them? SR 26-2 says model risk management benefits from "clear roles and responsibilities with well-defined accountability" and an inventory with "sufficient information to understand model risks" (Section VI). Shadow GenAI deployments fail this first.
• Who challenged it? Effective challenge means "critical analysis conducted by objective experts" with "sufficient independence to maintain objectivity" and the standing "to effect any change" (Section III).
• How was it tested, and against what? Testing "evaluates whether a model performs as intended," with rigor "commensurate with model complexity and materiality" (Section IV).
• How do you know it still works? Ongoing monitoring asks whether a model is "performing as expected given potential changes in products, exposures, activities, clients, data relevance, or market conditions" (Section V).
• What about the vendor model underneath? SR 26-2 notes banks "may not receive from the vendor the underlying code, data, or methodology," yet "the principles of model risk management remain applicable" to vendor products (Section VII). Nearly every bank GenAI system sits on a third-party foundation model.

None of these quotes binds a GenAI system. All of them describe what a credible answer looks like. A model risk team that adopts them as its internal standard for GenAI gives its board and its examiners a familiar frame for an unfamiliar technology.

A GenAI control set that mirrors SR 26-2 principles

The five controls below map the guidance's principles onto GenAI. For each one, we name the GenGuardX capability a bank can use to produce the evidence. The mapping mirrors the principles. It does not claim compliance with guidance that, by its own words, excludes GenAI.

1. Tiering by materiality

SR 26-2 ties rigor to materiality: "Model purpose, together with model exposure, determines model materiality," and higher materiality warrants "more comprehensive and rigorous oversight" (Section III). Apply the same logic to GenAI. A customer-facing collections agent warrants more than an internal search assistant.

In GenGuardX, inventory management registers datasets, models, prompts, RAGs and end-to-end agents in one place, and lineage tracking shows how each asset connects to the systems that use it. Tiering starts with knowing what you have.

2. Effective challenge

GenAI challenge needs two kinds of reviewers. Model risk validators bring independence. Fraud, lending and compliance SMEs bring the domain judgment to spot a fluent wrong answer.

Human Integrated Testing lets those SMEs run real scenarios, flag issues and rate responses, and annotation queues route the outputs that need a human. The Governed Workbench adds role-based access and approval workflows, so the record shows who challenged what, and who signed off.

3. Testing before use

A GenAI system has no single accuracy number. It needs tests for groundedness, policy adherence, fair lending, PII leakage and safe escalation, run against curated datasets and agreed thresholds.

GenGuardX runs standardized evaluations that are versioned and re-runnable. The Pipeline Builder compares whole agent configurations to find the safest setup, and Risk dashboards & curated reports cover policy adherence, fair lending, PII and explainability. The Trust Score rolls sub-metrics into one readiness measure, tracked version over version.

4. Ongoing monitoring

GenAI drifts without anyone touching it. Vendors update models. Inputs change. Agents shift behavior. A system that passed review in March can fail quietly by June.

GenGuardX supports monitoring for drift from the approved version, with alerts on live traffic. Findings from production feed new test cases, so the next review starts with more evidence than the last.

5. Documentation

SR 26-2 says documentation supports "the tracking of recommendations, responses, and exceptions" (Section VI). For GenAI, that record has to cover prompts, retrieval sources, guardrails and model versions, not only the model.

Lineage, versioning, approval history and evaluation reports in GenGuardX form one auditable record that business, model risk and compliance teams share. When an examiner asks how you know the assistant is safe, the answer is a link, not a slide.

FAQ

Does SR 26-2 apply to generative AI?

No. Footnote 3 of the SR 26-2 attachment states that generative AI and agentic AI models "are not within the scope of this guidance." It also says the bank's own risk management and governance practices should guide controls for systems the guidance does not cover.

Is SR 11-7 still in effect?

No. SR 26-2 "supersedes and replaces" SR 11-7 and SR 21-8. The agencies issued it on April 17, 2026. OCC Bulletin 2026-13 rescinds OCC Bulletin 2011-12, the OCC's version of the same 2011 guidance.

Does SR 26-2 apply to banks under $30 billion?

The guidance is "expected to be most relevant to banking organizations with over $30 billion in total assets." It "also may be relevant" to smaller banks with significant model risk exposure (OCC Bulletin 2026-13). The OCC also notes it "is applicable to all community banks, subject to the limitations discussed in the guidance."

Will regulators issue GenAI-specific guidance?

The agencies have said they plan "to issue in the near future a request for information" on model risk management that considers banks' use of generative and agentic AI (OCC Bulletin 2026-13). Until then, footnote 3 says the bank's own risk management and governance practices should guide the governance and controls for systems the guidance does not cover.

Last reviewed: October 16, 2026. This article summarizes public guidance and is not legal advice.

See how GenGuardX builds GenAI approval evidence for model risk teams.