SR 11-7 stopped being the operative US model risk standard on 17 April 2026. The Federal Reserve, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation replaced it that day with SR 26-2, OCC Bulletin 2026-13 and FDIC FIL-15-2026, rescinding the 2011 guidance, OCC Bulletin 2011-12, SR 21-8 on BSA and AML model risk, and the Comptroller’s Handbook booklet on model risk management.
Most coverage has read the change as a relaxation, which misses what actually happened. Five judgments that the 2011 text made for a bank are now judgments the bank makes for itself, and every one of them has to be defensible on request. The guidance got shorter because the decisions moved, not because they disappeared.
| Judgment | Who decided in 2011 | Who decides now | What defends it |
| Is this a model? | A broad definition captured it | You, against a narrower one | A written classification and its basis |
| Is it in scope at all? | Everything, at any bank | You, on assets and on technology | A scoping record and a bin decision |
| Is it material? | No such concept existed | You, on purpose and exposure | A materiality assessment |
| How often to validate? | At least annually | You, on risk | A cadence justified by risk, in writing |
| What governs the rest? | Nothing was outside | Your own risk framework | A method you designed and can show |
Each section below takes one of those judgments, gives the text that moved it, and names the record that answers for it.
Judgment one: the definition narrowed, so classification became yours
SR 11-7 defined a model in terms nearly everything quantitative satisfied:
For the purposes of this document, the term model refers to a quantitative method, system, or approach that applies statistical, economic, financial, or mathematical theories, techniques, and assumptions to process input data into quantitative estimates.
SR 26-2 defines it more tightly, and then adds an exclusion the 2011 text never had:
For the purposes of this guidance, the term “model” refers to a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates. The term “model” in this guidance excludes simple arithmetic calculations, such as those found within spreadsheets, as well as deterministic rule-based processes and software where there are no statistical, economic, or financial theories underpinning their design or use.
Four things moved. Complex was inserted, so a simple quantitative method is no longer a model. Mathematical theories were dropped, leaving statistical, economic and financial ones, which excludes a method resting on mathematical theory alone. Techniques, and assumptions were dropped, so the definition now reaches theories only. And spreadsheet arithmetic and deterministic rule-based software are expressly out.
Two more deletions are easy to miss. The 2011 definition carried a second sentence extending it to quantitative approaches whose inputs were partly or wholly qualitative or judgment-based, provided the output was quantitative; SR 26-2 does not reproduce it. And the 2011 attachment described a model as having three components, an information input component, a processing component and a reporting component. No tripartite structure appears anywhere in the 2026 text.
None of this makes classification easier. Classification is now a judgment call on a boundary the agencies drew and then declined to police, which means the artefact that matters is the written basis for each decision rather than the decision itself.
Judgment two: scope now turns on your balance sheet and on your technology
Two scoping gates sit in front of the guidance, and a bank has to clear both.
The first is size. SR 26-2 says it is expected to be most relevant to banking organisations with over $30 billion in total assets, and that models at institutions at or below that level are typically subject to internal risk management and governance practices appropriate to their size and risk profile. SR 26-2 leaves a door open: the guidance may still be relevant below the threshold where model risk exposure is significant because of the prevalence and complexity of models, or because of activities outside traditional community banking. Deciding whether you are through that door is your call.
The second gate is technological, and it is the one that reshapes AI governance in US banking. Footnote 3 reads in full:
Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance. Nonetheless, a banking organization’s risk management and governance practices should guide the determination of appropriate governance and controls for any tools, processes, or systems not covered in this document. However, the principles described in this guidance apply to traditional statistical and quantitative models and non-generative, non-agentic AI models.
The third sentence is the one most summaries drop, and it is the one most institutions need. Non-generative, non-agentic AI stays fully in scope. A gradient-boosted credit scorecard is in. A fraud classifier is in. A neural network forecasting deposit runoff is in. A ranking model is in. None of those generates content and none acts autonomously across systems.
So the practical test is not whether a system uses AI. The test is whether it generates content or acts with autonomy, and anyone reporting the April change as “AI is out of model risk scope” has it wrong in a way that will not survive an examination, because most AI in production at a US bank remains inside the guidance.
Adoption numbers make the sorting urgent rather than academic. The Federal Reserve’s FEDS Note of 3 April 2026 by Jeffrey S. Allen put AI adoption in the financial sector at about 30 per cent of firms against roughly 18 per cent across all US firms at the end of 2025, and found work-related generative AI use highest in financial services at 63 per cent of workers. The Cambridge Centre for Alternative Finance report of 28 April 2026, funded by the Bank for International Settlements, the International Monetary Fund and others, found more than 80 per cent of financial services firms adopting AI at some level, generative AI adoption at 71 per cent, and 52 per cent already experimenting with agentic AI. The scope of the framework contracted in the same quarter that the technology inside the firms expanded.
Judgment three: materiality is a new concept, and you assign it
The most consequential addition to the 2026 text is a word that does not appear in the 2011 definition at all. SR 26-2 builds a materiality test and hands the assessment to the institution.
Model risk under the new guidance is influenced by four things: a model’s inherent risk, its exposure, its purpose and its use. Inherent risk reflects the assumptions made in development, complexity, input quality and data constraints. Exposure refers to the significance of the output to business decisions and can be measured quantitatively, by portfolio size for instance. Purpose is a qualitative consideration, and the guidance says models developed to meet regulatory requirements or manage financial risk exposures are generally of greater risk than models that are not.
Then the mechanism:
Model purpose, together with model exposure, determines model materiality. Assessing risk based on model materiality is an important consideration for sound model risk management. Banking organizations may deem certain models immaterial based on model exposure and purpose. In those cases, model risk management may consist of identifying those models and monitoring model performance and conditions under which the use of those models may become material to the banking organization in the future.
Read what an immateriality finding buys. Model risk management for an immaterial model may consist of identifying it and watching for the conditions under which it becomes material. Inventory plus monitoring, and nothing else, which is a materially lighter obligation than anything SR 11-7 offered, and it is available only because the institution declared the model immaterial.
Which makes the materiality assessment the most consequential document in the whole framework. An immateriality finding converts a validation obligation into a monitoring obligation, and it is the first thing an examiner will want to see behind any model that is not being validated.
Judgment four: annual validation is gone, and the cadence is yours to justify
SR 11-7 set a floor in plain terms, asking banking organisations to conduct a periodic review of each model, at least annually and more frequently if warranted, to determine whether it is working as intended and whether existing validation activities are sufficient. Its validation framework then rested on three core elements: evaluation of conceptual soundness, ongoing monitoring including process verification and benchmarking, and outcomes analysis including back-testing.
SR 26-2 removes the floor, saying instead that the timing, nature and frequency of validation activities vary based on model purpose, model methodology, frequency and scope of model changes, data limitations and other practical constraints, and that the nature and rigour of validation generally align with the model’s approach, use and materiality.
The agencies had already signalled this. OCC Bulletin 2025-26 of 6 October 2025 told community banks that the guidance “does not, and should not be interpreted to, require community banks to perform annual model validation,” and that the OCC “will not provide negative supervisory feedback to a bank solely for the frequency or scope of the model validation that the bank reasonably determined to perform.” That bulletin was not rescinded in April; it survives the revision and is cited approvingly in it.
The transfer here is clean. Under the old text a bank that validated annually was compliant by construction. Under the new text there is no cadence to comply with, so the bank has to be able to explain why the cadence it chose was right for that model’s materiality and rate of change. Fewer validations, more justification.
Judgment five: the carved-out systems are governed by a method you invent
The middle sentence of footnote 3 decides what a bank actually does about the language model it put into production:
Nonetheless, a banking organization’s risk management and governance practices should guide the determination of appropriate governance and controls for any tools, processes, or systems not covered in this document.
The agencies did not say generative and agentic systems are ungoverned. The agencies said those systems sit outside this framework and inside yours. The obligation moved from a document with named sections and defined validation elements to an institution’s general practices, which have no named sections at all, and that is harder to evidence rather than easier. Under the guidance an examiner asks for a validation report and you produce one. Outside it, you decide what proves that your governance was appropriate, and then produce that.
There is a reason the carve-out exists, and understanding it tells you what to build. All three of the 2011 validation elements assume a stable mapping from input to output. Conceptual soundness asks whether the theory underlying a model is sound for its purpose, and a system whose behaviour emerges from a corpus nobody at the institution assembled offers no theory to evaluate. Ongoing monitoring compares current against expected performance, which needs a baseline that holds, and a vendor model updated without notice has none. Outcomes analysis back-tests predictions against realised results, which needs the output to be a prediction rather than a passage of text. The framework does not bend to non-determinism, so the agencies moved the systems rather than the framework.
What institutions are substituting, in the absence of anything named: evaluation against a fixed test set rather than validation against a theory, variance measurement across repeated runs rather than a single accuracy figure, human review sampling at a defined rate, versioning of prompts and configuration, and a record of what changed when a vendor shipped an update. None of that is in the guidance. All of it is what will be asked for when the promised consultation turns into something binding.
On which: the agencies said on 17 April that they plan to issue a request for information addressing model risk management generally and considering in particular banks’ use of AI, including generative AI, agentic AI and AI-based models. No such request has been published. A hundred and fifty days have passed, nothing has appeared in the Federal Register or in any agency’s bulletins, and the space where a framework for generative systems would sit remains empty.
What did not move: three binding obligations that outlast the guidance
Everything above is supervisory guidance, and guidance is not law. Three things that bind did not change in April, and for AI in US financial services they are where the real exposure now sits.
Adverse action reasoning. The Equal Credit Opportunity Act at 15 U.S.C. 1691(d)(2) requires a creditor taking adverse action to give a statement of specific reasons or notice of the right to obtain one. Regulation B at 12 CFR 1002.9(b)(2) requires that statement to be specific, to indicate the principal reasons, and it states expressly that a statement resting on the creditor’s internal standards or policies, or on failure to achieve a qualifying score, is insufficient. Binding regulation, then, and it applies whichever way a system was classified. The Consumer Financial Protection Bureau withdrew 67 guidance documents on 12 May 2025, 16 of them Consumer Financial Protection Circulars including 2022-03 on adverse action and complex algorithms and 2023-03 on adverse action notices. Withdrawing an interpretation does not withdraw the regulation it interpreted, and nothing has replaced them. A bank that cannot say why an application was declined has a Regulation B problem regardless of model risk scope.
Safety and soundness. SR 26-2 carries its own footnote on the point, preserving supervisory action for violations of law or unsafe or unsound practices stemming from insufficient management of model risk. The route runs through statute and through standards the agencies may set by regulation or guideline under 12 U.S.C. 1831p-1, not through the guidance.
Disclosure to investors. The Securities and Exchange Commission has brought AI-washing cases where firms overstated their use of the technology. On 18 March 2024 it settled with two investment advisers, Delphia (USA) Inc. for $225,000 and Global Predictions Inc. for $175,000. The Commission followed in October 2024 with Rimar Capital, at roughly $525,000 combined, and in January 2025 with Presto Automation, where cooperation credit meant no civil penalty. The Commission’s 2023 proposal on conflicts of interest in predictive data analytics was withdrawn on 17 June 2025, so there is no AI-specific rule for broker-dealers or advisers; the exposure is the ordinary antifraud one.
Generative AI in a US bank is therefore outside model risk guidance, inside Regulation B, inside safety and soundness, and inside the securities antifraud provisions. Less framework, not less liability.
The escalation route narrowed again three weeks ago
SR 26-2 contains a sentence that reads like a release:
This guidance does not set forth enforceable standards or prescriptive requirements; accordingly, non-compliance with this guidance will not result in supervisory criticism against a banking organization.
Its footnote points to 12 CFR Part 4, Subpart F, Appendix A for the OCC, Part 262, Appendix A for the Board, and Part 302, Appendix A for the FDIC, which are the codifications of the 2021 Role of Supervisory Guidance rule at 86 FR 9253. The 2021 rule states that supervisory guidance does not have the force and effect of law, that agencies do not take enforcement actions based on it, and that examiners will not criticise an institution through matters requiring attention for non-compliance with guidance.
Two complications sit against that. The Government Accountability Office concluded in decision B-331324 of 22 October 2019 that SR 11-7 met the Administrative Procedure Act definition of a rule and was therefore subject to Congressional Review Act submission before it could take effect. The decision reached the Federal Reserve’s letter only, not the OCC bulletin, but it is a direct finding that the label on the document did not settle its character. And practitioners have consistently reported that deviation from model risk guidance grounded a matter requiring attention in practice, whatever the 2021 rule said.
The second complication has now been addressed by rule. On 27 August 2026 the OCC issued Bulletin 2026-40 and a final rule on unsafe or unsound practices and matters requiring attention, published in the Federal Register on 1 September 2026, narrowing what examiners may cite as an MRA. Anyone assessing how a model risk or AI finding could be escalated needs to read the April guidance and the August rule together; the second is what determines whether the first can bite at all.
One correction worth making because it circulates widely. The OCC’s October 2020 Citibank consent order, AA-EC-2020-64, is regularly cited as model risk enforcement and is not. The order contains no reference to models, modelling or validation anywhere. Its Article V requires a data governance programme covering data quality, aggregation, regulatory reporting and end-user computing controls. Models consume that data, which makes the order adjacent to model risk without being an action about it.
Three other jurisdictions made the opposite choice
A bank operating across borders now gets different answers to the same question about the same system.
| Instrument | Jurisdiction | Status | AI inside the model definition? |
| SR 26-2, OCC 2026-13, FIL-15-2026 | United States | In force 17 Apr 2026 | No, generative and agentic expressly excluded |
| Guideline E-23 (2027) | Canada | Published 11 Sep 2025, effective 1 May 2027 | Yes, AI and ML methods named |
| Supervisory Statement SS1/23 | United Kingdom | Effective 17 May 2024, amended 23 Apr 2026 | Yes, applies regardless of technology |
| Draft Guidance on Model Risk Management, 2026 | India | Draft, released 24 Jun 2026 | Yes, AI and ML named |
Canada defines a model as an application of theoretical, empirical, judgmental assumptions or statistical techniques, including AI and machine learning methods, which processes input data to generate results. The Prudential Regulation Authority applies its five principles, model identification and risk classification, governance, development and implementation and use, independent validation, and model risk mitigants, to all models used to inform business decisions regardless of technology; its April 2026 amendment clarified that the expectations are not conditions for internal model approval and gave firms twelve months from a new permission to comply, without changing the policy. India’s draft names AI and machine learning inside the definition and reaches eleven categories of regulated entity.
Design to the widest of those definitions and the US position is satisfied automatically. Design to the US position and the other three are not.
The five records that answer for the five judgments
Each judgment above produces a document, and those five documents are now the substance of a US model risk programme.
| Judgment | Record that defends it | Reusable for |
| Is this a model? | Classification decision with the definitional basis stated | EU AI Act system classification |
| Is it in scope? | Scoping note covering the asset threshold and the technology test | ISO/IEC 42001 scope statement |
| Is it material? | Materiality assessment on purpose and exposure | Risk tiering across frameworks |
| What validation, how often? | Validation plan with the cadence justified against materiality and change rate | OSFI E-23 validation evidence |
| What about the carved-out systems? | The evaluation method you designed, with test set, variance and review sampling | Generative AI controls under any regime |
Two rows deserve a note. The classification record now carries weight it never had, because a system parked outside scope on the basis that it is generative needs a written reason, not an assumption. And the vendor position is moving underneath everyone: section VII of SR 26-2 applies the principles to vendor and third-party products, accepting that proprietary components may mean an institution never receives the underlying code, data or methodology, while on 11 September 2026 the OCC, Federal Reserve, FDIC and NCUA jointly proposed new third-party risk management guidance with a sixty-day comment period. Anyone rebuilding vendor model evidence this quarter should read the proposal before finalising the design.
Govern365.ai holds the mapping from a provision to the artefact that proves it, so the classification, the materiality assessment and the evaluation record exist as a standing set rather than being assembled under examination. Because one control usually answers several regimes, the same validation file can serve SR 26-2, Canada’s Guideline E-23 and ISO/IEC 42001, and one inventory entry can carry a US bin decision beside an EU AI Act classification. Our AI model inventory template and the distinction between an AI system registry and a model inventory are the place to start, third-party AI risk management covers the vendor row, and the AI compliance evidence guide sets out the artefact types across regimes.
Three things belong in this quarter’s plan. Re-run the inventory against the 2026 definition rather than the 2011 one, recording a classification basis for every system either way. Write the materiality assessment before anything else, because it is what licenses a lighter validation cadence and it is the first document an examiner will ask for. And check the Regulation B position separately, because it does not move when model risk scope does.
Frequently asked questions
Is SR 11-7 still in effect?
No. SR 11-7 was superseded on 17 April 2026 by SR 26-2, with OCC Bulletin 2026-13 and FDIC FIL-15-2026 issued the same day. OCC Bulletin 2011-12, SR 21-8 and the Comptroller’s Handbook booklet on model risk management were rescinded at the same time.
Does SR 11-7 apply to generative AI?
SR 11-7 no longer applies to anything. Its replacement states at footnote 3 that generative AI and agentic AI models are not within the scope of the guidance, while the principles continue to apply to traditional statistical and quantitative models and to non-generative, non-agentic AI models.
Did SR 11-7 ever mention artificial intelligence?
No. The 2011 text contains no reference to artificial intelligence, machine learning, generative AI, neural networks or large language models. Every application of it to AI was an analogy drawn by practitioners and examiners.
Is machine learning still in model risk scope?
Yes, in almost all cases. The carve-out reaches generative and agentic systems only. A gradient-boosted scorecard, a fraud classifier or a forecasting neural network generates no content and acts with no autonomy, so each stays within scope.
Does SR 26-2 still require annual model validation?
No, and neither did the 2011 text in the way it was commonly applied. SR 11-7 asked for periodic review at least annually. SR 26-2 ties timing, nature and frequency to model purpose, methodology, rate of change and data limitations. OCC Bulletin 2025-26 of 6 October 2025 had already told community banks the guidance does not require annual validation, and that bulletin survives the 2026 revision.
What is model materiality under SR 26-2?
Model purpose together with model exposure determines materiality. Where an institution deems a model immaterial, the guidance says model risk management may consist of identifying the model and monitoring the conditions under which it may become material. Materiality is therefore the document that licenses a lighter obligation.
What governs generative AI in a US bank if model risk guidance does not?
The guidance says an institution’s own risk management and governance practices should determine appropriate governance and controls for systems it does not cover. Binding law applies regardless: Regulation B on adverse action reasons, safety and soundness, and the securities antifraud provisions.
Can a bank be criticised for failing to follow SR 26-2?
The guidance says non-compliance will not result in supervisory criticism, consistent with the 2021 Role of Supervisory Guidance rule at 86 FR 9253. Its footnote preserves supervisory action for violations of law or unsafe or unsound practices stemming from insufficient management of model risk. The OCC’s final rule on matters requiring attention, issued 27 August 2026, further narrows what examiners may cite.
Which banks does SR 26-2 apply to?
It is expected to be most relevant to banking organisations with over $30 billion in total assets. Institutions below that are generally outside it, although it may still be relevant where model risk exposure is significant because of the prevalence and complexity of models or activities outside traditional community banking.
How do you validate a model that gives different answers to the same input?
The guidance does not say. Conceptual soundness, ongoing monitoring and outcomes analysis all assume a stable input-to-output mapping. Institutions substitute evaluation against a fixed test set, variance measurement across repeated runs, human review sampling at a defined rate, and versioning of prompts, configuration and vendor releases.
Do vendor AI models need validating?
Section VII of SR 26-2 applies the principles to vendor and third-party products, accepting that proprietary components may mean the institution never receives the underlying code, data or methodology. Sound practice is described as developing an understanding of the vendor model including conceptual soundness, design, development data and performance, with ongoing monitoring and outcome analysis. New interagency third-party risk management guidance was proposed on 11 September 2026 and is out for comment.
