SR 26-2 Replaced SR 11-7. Here Is What It Says, and Leaves to You, About AI.

The model risk team has been asked a question it cannot answer from the guidance on its shelf. The bank wants to put a generative AI step into a credit workflow: reading applicants’ documents and summarising them for the underwriter. Is that a model? Who validates it? What will the examiners ask?

For fifteen years the answer would have started with SR 11-7. In April 2026 that letter was replaced. Someone on the team has read the new one, and found that it says something about this exact question, in a footnote.

The paradox: The new guidance is clearer than the old one about AI, and the clearest thing it says is that the newest kind of AI is not covered.

What We Found

Before we recommend anything to a bank about AI governance, we read what its supervisors have actually said. For this article we read SR 26-2 and the interagency guidance attached to it, as published by the Federal Reserve on 17 April 2026, in full.

Four findings stand out.

SR 26-2 replaced SR 11-7, and it is tailored. On 17 April 2026 the Federal Reserve, the OCC and the FDIC issued revised guidance on model risk management, which “supersedes and replaces” SR 11-7 (2011) and SR 21-8 (2021). The guidance “is expected to be most relevant to banking organizations with over $30 billion in total assets”, and “may be relevant” to smaller ones “that have significant exposure to model risk”.

Not everything is a model. The guidance defines a model as “a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates”. It “excludes simple arithmetic calculations, such as those found within spreadsheets, as well as deterministic rule-based processes and software where there are no statistical, economic, or financial theories underpinning their design or use.”

Generative and agentic AI are outside its scope, and that is not the end of it. In the guidance’s own words: “Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance. Nonetheless, a banking organization’s risk management and governance practices should guide the determination of appropriate governance and controls for any tools, processes, or systems not covered in this document. However, the principles described in this guidance apply to traditional statistical and quantitative models and non-generative, non-agentic AI models.”

For models in scope, the expectations are evidence. The guidance describes “effective challenge”, “the critical analysis conducted by objective experts”. It says validation “evaluates whether models perform as expected and includes an assessment of a model’s reliability and its limitations”, and that outcomes analysis “compares model outputs to corresponding real-world outcomes”. For vendor and third-party models, “the principles of model risk management remain applicable”, including ongoing monitoring and outcome analysis “to assess whether vendor models are accurate, remain fit for purpose, and continue to be reliable”.

What our review does not show: This is supervisory guidance, and we describe it, not the law that sits behind it. We are not a law firm, and nothing here is legal advice. We did not find, in the public record, how examiners are applying the footnote on generative and agentic AI in practice. The guidance does not say where the line falls in a system that mixes a generative step with a statistical model and fixed rules. Those are questions for each bank’s model risk function and counsel.

The Workflow That Is Now Three Things

Our reading of the guidance is that a modern AI workflow at a bank is no longer one thing for governance purposes. It is up to three.

A step that applies statistical theory to produce an estimate, such as a credit score or a fraud probability, is a model in the guidance’s terms, and a non-generative AI model is treated the same way. Effective challenge, validation, outcomes analysis and an inventory entry all apply.

A generative or agentic step, such as reading documents, summarising a file or drafting a letter, is outside the guidance’s scope. The bank’s own risk management and governance “should guide” the controls for it. The guidance gives no checklist for that.

A step that applies fixed rules, such as an eligibility policy or a pricing table written as code, is excluded from the term “model” where no statistical, economic or financial theory underpins it. That does not mean it needs no control; it means its controls come from the bank’s wider governance of software and policy.

The gap we see: many banks will try to fit every AI step into the model framework, or treat everything generative as experimental. Banks that sort each workflow step into these three, record which governance applies to each, and keep generative steps out of the decision itself, can show examiners a complete picture without stretching guidance to cover what it explicitly does not.

This is our reading of the guidance. It is not legal advice and not a measured market figure.

Four Ways to Govern an AI Workflow After SR 26-2, Weighed

Option	When it fits	What it risks
Treat every AI step as a model under the guidance	A small number of AI steps, and a strong model risk function	Methods built for statistical models fit generative steps poorly; effort spent where the guidance does not apply
Treat generative steps as out of scope and govern them lightly	Internal tools where no decision rests on the output	The guidance says the bank’s own risk management should guide their governance; a light touch is hard to defend if a decision depends on them
Keep generative steps out of the decision: models where statistics apply, fixed rules where policy applies	Credit, fraud and pricing decisions that must be explained	Policy has to be written down as rules and change-controlled
Build a separate governance framework for generative and agentic AI under the bank’s own risk management	The bank intends to put generative AI into decisions	A new framework, with supervisory expectations still developing

Our recommendation: sort every step of each AI workflow into the three kinds above, put all of them in one inventory with the governance that applies to each, and keep generative and agentic steps out of the decision itself wherever possible. Take the boundary cases to your model risk function and counsel early.

Where You Are Now, and Where You Should Be

Measure	Typical starting point	Where it should be	How it is checked
Each AI step classified	”AI” listed as one item	Each step recorded as an in-scope model, a generative or agentic step, or fixed rules	The bank’s inventory
Governance for generative and agentic steps	Pilot-level, informal	Written under the bank’s own risk management, with an owner per step	Governance records
Evidence for in-scope models	Development notes	Effective challenge, validation and outcomes analysis on file	Model risk files
Vendor models	Vendor documentation only	The bank’s own understanding, monitoring and outcome analysis	Vendor model reviews
Where decisions are made	Mixed into a generative step	In models or fixed rules the bank can explain	A trace from each decision to its source

The starting points above are what we expect to find. In an engagement they are replaced by your own figures, taken in the first review. The targets are what we would work towards with you. They are not results we have already achieved for a client.

How We Work With You

1. We listen: a free Reliability Review. A first conversation about the workflow, how it is governed today and what your model risk team has asked. You leave with a short written note of what we found.
2. We research. We research your sector, the regulator’s position and what the public record says about firms in your situation. This article is an example of that work.
3. We diagnose: the Workflow Diagnostic. It sorts each step of the workflow into compile, keep on an AI model, or don’t automate, and includes a 100-rerun consistency test of your current pilot, a policy-to-rules map, the evidence gaps, the cost per case today against projected, and a change plan. It may recommend another firm or tool, or not automating at all. We take no referral fees on model or platform recommendations.
4. If you approve, we prove it: a Proof Sprint. One workflow, on your own cases, measured for consistency and for accuracy against your own experts. You keep the code.
5. We review against the benchmark. Before work starts we set the benchmark. At each stage we show you where each measure stands, and the filled-in benchmark is yours at the end.

The Review is free. Every paid step is fixed price, agreed at scoping. Stop after any step. The findings are yours. The Diagnostic fee is credited against a Proof Sprint within 90 days.

IOanyT’s own AI management system is certified to ISO/IEC 42001. That certifies how we run our own AI work, not any client’s system or deliverable.

What changes for the business:

Role	What they gain
CRO or Head of Compliance	An inventory that says, for every AI step, whether SR 26-2 applies and what governance covers it either way.
CFO	Model risk effort spent where the guidance applies and the exposure is, not on stretching it to cover what it excludes.
CTO or CIO	A clear design rule: generative steps read and draft, and decisions run in models or fixed rules the bank can explain.
Head of AI or Data	Generative pilots with a governance path the risk function can sign, instead of an open question.
CEO	An answer for the board and the examiners on how the bank’s AI is governed now that SR 11-7 has been replaced.

The cases in this article, and what IOanyT does about that kind of problem:

The case	What IOanyT does
This article names no organisation as a case. The Federal Reserve, the OCC and the FDIC are named as the authors of the guidance.	The Workflow Diagnostic sorts each step of a workflow and sets out the evidence that exists for it, which the bank can use in its own governance and model risk work.

IOanyT is a consultancy with its own engineering team: we study the problem, recommend, and prove it by building only what you approve. Where a boundary needs counsel, we say so and stop there.

Book a free Reliability Review →

Get a fixed quote →

See the Workflow Diagnostic →