Supervisory Guidance on Model Risk Management (SR 26-2, replacing SR 11-7)

What it is

SR 26-2, Supervisory Guidance on Model Risk Management, was issued on 17 April 2026 jointly by the Board of Governors of the Federal Reserve System, the Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC). It supersedes SR 11-7 of April 2011 and SR 21-8 of April 2021, the interagency statement on model risk management for anti-money laundering systems. The OCC issued it as Bulletin 2026-13, rescinding Bulletin 2011-12.

For fifteen years SR 11-7 was the reference point for model risk in US banking, and by extension the de facto standard banks applied to AI and machine learning models. Many AI governance programmes in financial services were built on it. SR 26-2 keeps its core ideas but makes the approach explicitly risk-based and tailored, and draws a clear line around what counts as a model.

Who it applies to

The guidance is addressed to banking organisations supervised by the three agencies. It is expected to be most relevant to those with more than US$30 billion in total assets, and the agencies note that smaller organisations generally manage models through practices suited to their size. It may still be relevant to smaller organisations with significant model risk because of the prevalence and complexity of their models or activities outside traditional community banking.

A model is a complex quantitative method, system or approach that applies statistical, economic or financial theories to process input data into quantitative estimates. Simple spreadsheet calculations, and deterministic rule-based processes and software with no such theory underpinning them, are excluded.

The guidance applies to traditional statistical and quantitative models and to non-generative, non-agentic AI models. Generative AI and agentic AI models are expressly outside its scope, which the agencies describe as novel and rapidly evolving. For those, a bank’s broader risk management and governance practices are expected to set the appropriate controls. When they issued the guidance, the agencies said they planned a request for information on model risk and banks’ use of AI, including generative and agentic AI.

What it expects

The guidance is principles-based. It states that it does not set enforceable standards or prescriptive requirements, and that non-compliance with it alone will not result in supervisory criticism. Supervisory action can still follow for violations of law or unsafe or unsound practices arising from weak model risk management.

Model risk and materiality. Model risk is the potential for adverse financial consequences from decisions based on model output. It reflects a model’s inherent risk (its assumptions, complexity, input quality and data constraints) in the context of its materiality, which combines exposure (how significant the output is to business decisions) and purpose (for example, regulatory or financial risk uses are higher risk). Immaterial models may need little more than identification and monitoring, while material models warrant rigorous oversight. Risk is assessed for each model and in aggregate, since models can share data, assumptions or methods.

Effective challenge. Critical analysis by objective experts with the expertise, independence and standing to make change happen, throughout the life cycle.

Model development and use. Development aligned with purpose, business use and policy, with sound data, documented methodology and testing, and use within the model’s intended scope and known limitations.

Validation and monitoring. Validation that assesses whether a model performs as expected and identifies its limitations, scaled to its approach, use and materiality, generally before first use. Ongoing monitoring to detect when a model drifts from its expected performance.

Governance and controls. Policies that set expectations and a way to size model risk, procedures for monitoring and control, clear roles and accountability that manage conflicts between development and validation, a defined role for internal audit, and a model inventory with enough information to understand each model’s risk.

Vendor and third-party products. Vendor models and data present particular challenges for validation because of limited transparency. Banks are expected to validate vendor products, understand how they were developed and customised, and manage the related risk.

Key dates

• 4 April 2011. SR 11-7 issued.
• 17 April 2026. SR 26-2 issued, superseding SR 11-7 and SR 21-8.

How it relates to other frameworks

SR 26-2 now diverges from its closest foreign counterpart. Canada’s OSFI Guideline E-23, effective May 2027, explicitly brings AI and machine learning models into model risk management. The US guidance instead puts generative and agentic AI outside model risk altogether. A bank using large language models or agents has to govern them through its broader risk and technology frameworks, which is where the NIST AI RMF, the NIST Generative AI Profile and ISO/IEC 42001 come in.

For machine learning models that remain in scope, SR 26-2’s inventory, validation, monitoring and vendor expectations line up with the Map, Measure and Manage functions of the NIST AI RMF. Insurers face parallel expectations through the NAIC AI Model Bulletin, and banks using AI in credit decisions about consumers also need to consider fair lending law and state laws such as Colorado SB 26-189.