SR 26-2

SR 26-2 is the current supervisory guidance from the Federal Reserve, issued alongside OCC Bulletin 2026-13 and FDIC FIL-15-2026, that sets expectations for how banks identify, manage, and validate model risk.

SR 26-2 took effect on April 17, 2026, and it replaced the Federal Reserve's prior model risk management guidance, SR 11-7, which is now retired and should not be cited as a current standard. Like its predecessor, SR 26-2 requires banks to maintain a documented, defensible model risk management program built around a model inventory, independent validation before and periodically after deployment, clearly documented assumptions and limitations, and ongoing monitoring for performance drift. Its core expectation has not changed: a bank should be able to show a regulator exactly what a model does, why it was approved, and how its risk is being managed.

What is new, and what governance and compliance leaders most need to understand, is that SR 26-2 explicitly excludes generative and agentic AI systems from traditional model risk scope. That does not mean those systems are unregulated. It means the model risk framework built for statistical and predictive models does not automatically extend to a generative AI tool or an autonomous agent, and a bank cannot assume that running an AI system through existing model validation covers it. Banks are expected to govern generative and agentic AI through their own AI governance programs, built for how those systems actually behave: what knowledge they retrieve, what data they touch, and how their outputs are reviewed.

For many banks, this creates a real gap. Model risk teams have spent years building a mature validation and inventory process for models under SR 11-7 and now SR 26-2, but that infrastructure was not built to cover the AI copilots, agents, and generative tools now spreading through the business. Closing that gap means standing up a governance approach with visibility into what those systems touch and how they behave, not stretching the existing model risk playbook to fit.

How SR 26-2 relates to model risk management and AI governance

Model risk management is the broader discipline SR 26-2 governs for traditional models; SR 26-2 is the specific, current rule set. AI governance is the separate program banks now need to build for the generative and agentic AI systems SR 26-2 excludes from model risk scope. The two should work together, since a model that later gets wrapped in a generative interface, or an agent that calls a traditional model, can straddle both categories.

What SR 26-2 Changes for Compliance Teams

For a bank's governance or compliance leader, the SR 26-2 carve out means they now need documented visibility into what data and application logic touch each generative or agentic AI system, similar in spirit to a model inventory but built for AI pipelines rather than statistical models. Mapping precisely which data sources, tables, and application code feed a given AI system, through source code analysis, gives governance teams for AI the same kind of defensible, current record that model risk teams have long built for traditional models.

Related glossary terms

• Model Risk Management
• AI Governance
• EU AI Act

Frequently asked questions

Is SR 11-7 still the standard for bank model risk management?

No, SR 11-7 is retired. It was the Federal Reserve's guidance on model risk management for many years, but it was formally superseded by SR 26-2, issued jointly with OCC Bulletin 2026-13 and FDIC FIL-15-2026, effective April 17, 2026. Banks and examiners should treat SR 26-2 as the current standard and should not rely on SR 11-7 as an active requirement.

Does SR 26-2 cover generative AI and AI agents?

Not in the way traditional models are covered. SR 26-2 explicitly excludes generative and agentic AI from the scope of traditional model risk management. A bank cannot assume its existing model validation program automatically covers a generative AI tool or an autonomous agent. Those systems still need governance, but banks are expected to build it through a dedicated AI governance program rather than relying on model risk exemption.

What do banks need to do to close the gap SR 26-2 creates?

They need visibility into generative and agentic AI systems comparable to what model risk teams already maintain for statistical models: an inventory of where those systems are used, what data and application logic they touch, and a documented basis for trusting their outputs. In practice, that usually means extending governance into the code and pipelines behind AI systems, not just monitoring their outputs.