SR 26-2 replaces long-standing US model risk guidance with a more explicitly risk-based and proportionate approach. It is expected to be most relevant to institutions above $30 billion in assets, but may also matter to smaller banks with significant model exposure. Crucially, the guidance excludes generative and agentic AI from scope. Regional banks therefore need a governance architecture that uses SR 26-2 principles without assuming the guidance covers the full AI estate.
Does SR 26-2 cover generative and agentic AI used by banks?
No. SR 26-2 explicitly states that generative and agentic AI models are outside its scope because they are novel and rapidly evolving. It also says a bank’s broader risk management and governance practices should determine appropriate controls for tools, processes, and systems not covered by the guidance.
Why SR 26-2 matters now
On April 17, 2026, the Federal Reserve, OCC, and FDIC issued revised interagency guidance on model risk management. Federal Reserve letter SR 26-2 supersedes SR 11-7 and SR 21-8. The revision reflects fifteen years of supervisory experience and substantial changes in modeling practice.
The shift is material for US banks. The guidance emphasizes a risk-based approach tailored to the institution’s model profile, size, complexity, purpose, and exposure. It also recognizes that the same model may carry different risk at different institutions because business use determines consequence.
For regional banks, this is a more useful premise than a uniform control checklist. It directs governance resources toward material models rather than requiring identical treatment for every analytical tool.
The $30 billion threshold is not a blanket exemption
SR 26-2 says the guidance is expected to be most relevant to banking organizations with more than $30 billion in total assets. Models at smaller institutions are generally subject to internal governance appropriate to the bank’s size and risk profile.
However, the guidance may still be relevant below that threshold when an institution has significant model risk because of the prevalence or complexity of its models or activities beyond traditional community banking.
That nuance matters. A bank should not translate the threshold into a conclusion that sophisticated credit, fraud, pricing, AML, or market-risk models require limited oversight. Materiality depends on purpose and exposure, not assets alone.
The generative and agentic AI boundary is explicit
The most consequential footnote in SR 26-2 may be the one defining its limits. Generative AI and agentic AI are not within scope. The document says its principles apply to traditional statistical and quantitative models and to non-generative, non-agentic AI models.
This is not permission to leave newer AI ungoverned. It is recognition that model risk management alone does not fully describe systems whose behavior depends on prompts, retrieved context, tools, memory, orchestration, and multi-step actions.
A bank that places a generative assistant in customer servicing or an agent in a payment-exception workflow must govern the whole system, even when its foundation model sits outside the technical definition used by SR 26-2.
Use SR 26-2 as a foundation, not a false perimeter
Several SR 26-2 principles remain highly valuable beyond formal scope. Purpose should be clearly defined. Testing should reflect intended use and materiality. Users should understand limitations. Validation and monitoring should respond to changing conditions. Roles should be clear. Vendor products require bank-specific understanding, validation, and outcome analysis.
The gap appears when institutions stop at the model. Generative and agentic deployments require additional controls around prompt and context versioning, retrieval quality, tool permissions, action limits, human approval, decision lineage, safe failure, and scenario-based evaluation.
The operating model should connect these controls to existing model risk, compliance, data, cyber, third-party risk, and operational risk processes. Creating a completely separate AI policy stack can reproduce the fragmentation the bank is trying to solve.
A proportionate control model for regional banks
Regional institutions rarely have the specialist bench to build separate review processes for every AI category. Proportionality should be designed into the workflow.
Classify each deployment using purpose, customer impact, financial exposure, autonomy, reversibility, data sensitivity, scale, and regulatory relevance. Low-risk internal assistance may need approved tools, data restrictions, logging, and sampling. Employee decision support requires stronger grounding, evaluation, and review.
AI that influences credit, fraud disposition, payments, regulatory reporting, or customer eligibility requires rigorous testing, continuous monitoring, reconstructable evidence, and explicit authority boundaries.
A small number of practical tiers is more enforceable than a complex taxonomy. Each tier should map to a standard evidence pack and approval route.
What should CIOs and CROs do next?
First, reconcile the model inventory with the wider AI-use inventory. Identify applications excluded from the model definition, including embedded vendor features and employee-adopted generative tools.
Second, distinguish which controls are inherited from model risk management and which must be added for system-level behavior. Third, assign an accountable business owner and technical owner for every material outcome. Fourth, define monitoring triggers that can change a use’s risk tier as its scale, autonomy, data, or purpose changes.
The objective is not to stretch SR 26-2 until it appears to cover everything. It is to build a coherent governance perimeter in which no consequential form of intelligence sits outside accountable control.
What this means for banking leaders
• SR 26-2 replaces SR 11-7 and SR 21-8 with a more risk-based, proportionate model risk approach.
• Its relevance may extend below $30 billion when model exposure or complexity is significant.
• Generative and agentic AI are explicitly outside the guidance’s scope.
• Banks should extend proven model risk principles with system-level controls for context, tools, actions, and outcomes.
Conclusion
SR 26-2 gives regional banks a clearer way to align model risk controls with materiality. It does not solve the governance question for every form of AI. The institutions best positioned to scale will use the revised guidance as a disciplined foundation while engineering a broader accountability architecture for generative and agentic systems.
Explore the full CIO and CRO mandate
The fifth paper in Maveric Systems’ CIO Mandate Series sets out the Enterprise AI Accountability Architecture, regulatory convergence, governance maturity model, and 24-month implementation roadmap.
FAQ
What guidance did SR 26-2 replace?
It superseded Federal Reserve letters SR 11-7 and SR 21-8.
Which banks are most affected by SR 26-2?
It is expected to be most relevant to banking organizations above $30 billion in assets, but can also matter to smaller institutions with significant model exposure or complexity.
Does SR 26-2 create enforceable standards?
The guidance states that it does not establish enforceable standards or prescriptive requirements. Violations of law or unsafe and unsound practices related to poor model risk management can still prompt supervisory action.
Are generative AI and agentic AI models covered?
No. They are explicitly excluded from the guidance’s scope, although banks should still apply appropriate governance and controls through their broader risk framework.
How should a regional bank govern AI outside SR 26-2?
Use risk-tiered system governance covering data, prompts, retrieval, tools, actions, human oversight, monitoring, lineage, security, and outcomes.
