AI Model Risk Management Compliance Requirements for Banks

The Federal Reserve, FDIC, and OCC together revoked SR 11-7, OCC Bulletin 2011-12, FIL-22-2017, plus SR 21-8 alongside several connected BSA/AML directives on April 17 of 2026, issuing SR 26-2, OCC Bulletin 2026-13 along with FDIC FIL-15-2026 as immediate substitutes. Under the old rule, SR 11-7 treated any quantitative technique, system, or method relying on mathematical, financial, economic, or statistical theories and assumptions to transform raw inputs into numerical projections as a model. SR 26-2 answers by shrinking the supervisory definition of a model, tightening governance for whatever remains covered, and centering the entire framework on risk-tiering.

What SR 26-2 Covers and Excludes

SR 26-2 covers conventional statistical models and quantitative models, as well as AI systems that are neither generative nor agentic, but expressly excludes those that are from its scope. By carving out these technologies, a governance gap emerges precisely when banks are rapidly adopting such tools, which is the most critical aspect of the new framework for compliance teams assessing the rules for chatbots or LLM-based assistants. The guidance characterizes these AI systems as "novel and rapidly evolving," phrasing that suggests an interim exemption. An upcoming Request for Information from multiple agencies will focus on these systems, so binding guidance is on the way. That same package uses OCC Bulletin 2026-13 to pull the Comptroller's model risk management booklet from its Handbook, fully retiring the earlier interpretive framework as the new rule takes over. That does not leave generative and agentic tools without oversight today. Under that framework, SR 26-2's principles extend to such systems by analogy, with examiners and in-house audit groups already enforcing model risk management standards on LLM-based underwriting assistants, AML triage bots, and client-facing copilots despite their formal exclusion from the regulation itself.

Proportionality in Practice: Tiered Controls

Under SR 26-2, models are assigned to tiers based on their purpose, exposure, and inherent risk, with controls scaled accordingly. For Tier-1 material models, this means governing every phase through documented development, separate validation, continuous monitoring, and analysis of outcomes. An undocumented or unjustified tiering rationale becomes a separate audit vulnerability, even when the placement itself is correct. Oversight should fit the specific tier assigned to every model. The entire lifespan, spanning creation, approval, rollout, tracking, and decommissioning, must operate as one unified oversight sequence where traceability ties each stage together. Effective challenge now relies on tracked, repeatable challenger models plus outcome reviews, benchmark comparisons, and sensitivity checks, not a one-time validation memo kept in the file. Ongoing surveillance measures changes in performance, shifts in input data, and model steadiness against materiality-calibrated thresholds. Those governance principles also guide AI systems that the rule does not formally cover. Across all five, the push to “shift left” places risk controls earlier in the model lifecycle as supervisors move beyond after-the-fact review, long the hallmark of SR 11-7.

Which institutions bear the heaviest compliance burden, and why size alone does not determine it

SR 26-2 speaks mainly to banking organizations with total assets above $30 billion, and its detailed lifecycle expectations were scaled to fit institutions of that size. The framework still reaches banks below that threshold. OCC Bulletin 2025-26 makes clear that community banks need not put their models through validation every year, a helpful carve-out showing that proportionality applies to the institution as a whole, not merely to each model one at a time. What that means on the ground is that any given bank's compliance intensity reflects a pair of factors acting in combination: how large and complex the institution is, and how material each model is and what risk tier it falls in. Neither one, taken alone, determines how heavy the load will be. A modest community bank with just one credit model in the top risk tier may find that model subject to tougher validation demands than a big institution whose whole lineup sits in lower tiers, so a program keyed only to asset size will misread where its true exposure lies.

The model inventory problem: why SR 26-2 compliance starts with knowing what you have

Proportionate, tiered controls require an institution to first locate every model, yet many banks still maintain incomplete inventories. Resolving such blind spots stands as the clearest, most pressing task from the updated rules, making reconciliation the initial 90-day focus for every compliance group rolling out SR 26-2. Each entry must capture sufficient detail to justify its classification, including purpose, ownership, exposure, inherent risk, and a written explanation for the tier chosen. Tools built on generative or agentic AI defy easy classification as "models" per SR 26-2, but omitting them from the roster altogether surrenders all oversight authority. These tools require their own routing choice, one that puts them on a separate control pathway inside the institution's AI governance framework instead of pushing them into a category made for statistical models. Vendor and outside models belong in this inventory too. Purchasing it from a vendor leaves responsibility for its performance intact.

The explainability obligation that SR 26-2 does not relieve: ECOA, Regulation B, and adverse-action notices

Any bank using an AI model in credit decisioning carries an explainability obligation that exists entirely apart from SR 26-2, and model complexity, proprietary architecture, or a vendor relationship cannot extinguish it. ECOA and Regulation B require a bank denying credit to give the applicant specific, accurate reasons for that denial, a duty that applies no matter how the underlying decision was produced. CFPB Circular 2026-03, issued in May 2026, confirms that lenders using machine-learning underwriting models remain fully responsible under ECOA and Regulation B for providing those specific, accurate reasons, and the circular states directly that model complexity, proprietary architecture, and vendor relationships are not a defense against that responsibility. The fair-lending landscape around this obligation shifted in the same month SR 26-2 took effect. In April 2026 the CFPB finalized a rule narrowing ECOA enforcement by removing disparate-impact liability under Regulation B, refocusing federal enforcement on intentional discrimination, while FHA and state-law disparate-impact claims remain intact. State regulators and state attorneys general keep pursuing disparate-impact claims even as federal enforcement retreats. The notice obligation for adverse action came through the change unscathed. In practical terms, a compliance program must let a bank show, for each automated denial, the particular grounds on which it rested. That ability depends on capturing and tracing how the model reaches each outcome and on stating those reasons in language an applicant can grasp. Tools that shed light on model behavior, such as LIME explanations, SHAP values, and feature importance outputs, are already in use for this purpose, but no regulator has specified which of them will suffice. Some banks run a pair of models, one strong performer for risk segmentation and one simpler, more transparent one that supplies the reasons given in adverse-action notices, yet no regulator has formally blessed this arrangement as a safe harbor for compliance.

Third-party and vendor model governance: the compliance gap SR 26-2 opens but does not close

Handing a vendor an AI model does not transfer the associated risk accountability away from the bank. Financial institutions retain the duty to validate, oversee, and analyze results for externally sourced models, even when proprietary design restricts visibility into their inner workings. The FFIEC's IT Examination Handbook establishes technology controls for AI systems, requiring examiners to apply the same standards for secure development, operational resilience, and access control to externally run models as to those built internally. To close the vendor governance shortfall that SR 26-2 only partly resolved, the OCC, Federal Reserve, FDIC, and NCUA together released fresh third-party risk management guidance on September 11, 2026. The proposal has not yet left the comment stage, and it signals the coming set of obligations for this area. For compliance today, an institution should treat any AI model it reaches via an outside API as a relationship it oversees directly, recording the human-intervention authority tied to each vendor’s model and linking monitoring triggers to bank-controlled steps for escalation and rollback. Banks should also examine the subcontractor layer supporting their AI vendors, because downstream AI dependencies used by the vendor may shift governance duties beyond the bank’s direct contract.

The generative and agentic AI governance gap: what banks must do before formal guidance arrives

SR 26-2's exclusion of generative and agentic AI creates a governance vacuum at the exact moment banks most need a framework to fill it, and the only defensible response available to a compliance team is to apply SR 26-2's principles by analogy while building a separate, documented control pathway for these systems. The exclusion has a sound technical justification. The practical objection carries equal weight. Banks are deploying LLM-based underwriting assistants, AML triage agents, and customer-facing copilots now, and supervisors and internal audit teams are already applying model risk management expectations to these systems by analogy. Institutions face examination risk today on systems for which no formal rule yet exists. Three failure modes concentrate around this gap: whether an AI system can access or infer data outside its authorized scope, whether the bank can actually shut the system down once it begins behaving unexpectedly, and whether third-party AI vendors and their subcontractors are held to the same governance standard the bank itself is expected to meet. That exclusion draws a line around scope, but it is not permission to skip governance. The CFPB has also issued its own alert regarding conversational AI tools used by banks, cautioning that firms may breach statutory duties and harm consumers through such technology. Those safeguards for consumers still govern AI agents built on generative models, regardless of the scope defined in SR 26-2. Both GLBA together with the FTC Safeguards Rule require firms to shield client financial information fed into every AI tool, including generative systems: though the ingestion path is novel, the duty is not, so organizations need to apply their privacy and security safeguards at the exact point of model input. Until regulators finalize their rules, two industry-spanning voluntary models provide practical approaches. The NIST AI Risk Management Framework structures its guidance around four functions, namely Govern alongside Map plus Measure and Manage, while ISO/IEC 42001 remains the inaugural certifiable standard for AI management systems.

The International Overlay for Cross-Border AI Operations

Compared with the American counterpart, the EU framework sets out more detailed requirements in several areas. Under Annex III of the EU AI Act, systems used in personal creditworthiness assessment or credit-score generation are treated as high risk, so credit decisioning must satisfy the Act’s complete lifecycle regime, from risk controls and dataset oversight to records, traceability, human review, performance, resilience, and security. The Digital Omnibus revision adopted in July 2026 shifted Annex III high-risk compliance to December 2, 2027, replacing the original August 2, 2026 schedule. DORA took effect on January 17, 2025, and reaches AI-related ICT reliance, supplier diligence, contractual terms, audit access, incident handling, and exit planning. In another market, the prudential supervisor addresses AI and machine learning under its model-risk-management framework, whose latest version has applied since April 23, 2026, covering all model categories, including vendor models. A bank operating solely at home is not bound by these measures directly, yet the EU and UK approaches show the same cross-border movement toward the risk tiers and lifecycle controls that SR 26-2 also reflects.

Governor Bowman's Supervisory Framing and the Pending GenAI RFI

Supervisory scrutiny of artificial intelligence exposures has moved past what SR 26-2 literally covers. Examiners now probe individual AI rollouts through a materiality lens rather than enforcing a single standard everywhere, meaning institutions that align oversight with those real inquiries instead of the document's strict boundaries stand to gain when today's practice hardens into law. During a July 7, 2026 address, the Vice Chair for Supervision, Bowman, specified the inquiries examiners should direct at each AI rollout: its significance to the institution's operations, how widely employees may access it versus strict limitations, plus direct customer impact. This triad of significance tests functions beyond the boundaries SR 26-2 defines, offering compliance teams a proxy for where supervisory attention will land even when no binding rule applies yet. The Request for Information regulators across agencies are preparing, focused on managing risk in AI models covering both generative and agentic uses, will shape the path for the next binding guidance. The governance setup a bank establishes now for those systems will either emerge as the standard the RFI confirms or the problem the RFI process uncovers. Pulling a compliance posture together today so it holds up under that shift means one unified model register that records each tiering decision in writing, distinct control tracks covering SR 26-2-scoped models, agentic generative systems, and outside-vendor offerings, operational lineage that yields governance evidence as routine output instead of being reassembled after the fact when examiners arrive, and alert limits linked directly to the bank's own escalation, rollback-and-retirement calls. The SR 26-2 compliance work required today lays the basic foundation for a framework regulators have not yet finished drafting.