🏦 SR 11-7 is gone. SR 26-2 replaced it on April 17, 2026 — and most banks’ model risk programs have not caught up. This guide explains what changed, what stayed the same, what SR 26-2 explicitly excludes, and how to build a compliant model risk management program for both traditional AI and the generative AI systems your framework currently leaves ungoverned.
Last Updated: October 8, 2026
On April 17, 2026, the Federal Reserve, the OCC, and the FDIC jointly issued SR 26-2 — the first overhaul of US model risk management guidance in fifteen years. SR 26-2 supersedes and replaces SR 11-7 (2011) and SR 21-8 (2021) in full. It is now the current standard. Any bank or financial institution that describes its model risk management program as “SR 11-7 compliant” is referencing a retired framework — a distinction that examiners, auditors, and enterprise procurement teams are now actively making. The core intellectual architecture of sound model risk management is preserved: model inventory, independent validation, ongoing monitoring, effective challenge, governance, and third-party oversight remain the foundational disciplines. What changed is how those disciplines are applied — from a prescriptive, uniform rulebook to a principles-based, risk-proportionate framework calibrated to each institution’s model risk profile, size, and complexity.
The shift matters more than it might initially appear. SR 11-7 was treated as de facto binding — deviations triggered Matters Requiring Attention and drove ratings downgrades, even after a 2019 GAO ruling classified it as a rule under the Congressional Review Act. SR 26-2 explicitly closes that gap: it is principles-based guidance, not a prescriptive rulebook enforced clause by clause. Non-compliance with the guidance text itself will not, on its own, result in supervisory criticism. But this is not a signal that model risk oversight has relaxed. It is a transfer of responsibility — from regulators who defined the procedure to institutions that must now demonstrate the judgment. The institutions that interpret the shift as a loosening of standards will be precisely the ones that face examination scrutiny. For banks and fintechs operating across both US and EU jurisdictions, SR 26-2 intersects with EU AI Act requirements for high-risk AI systems in financial services — including credit scoring, underwriting, and fraud detection — creating a dual compliance layer that a single model risk management framework must address.
This guide covers SR 26-2 in full: what it requires, what it changed from SR 11-7, the critical governance gap it creates for generative and agentic AI, how to build a compliant model inventory and tiering system, what independent validation means under the new framework, and how to map SR 26-2 obligations against EU AI Act and ISO 42001 requirements for institutions operating across jurisdictions. Every regulatory reference is current as of October 2026.
📖 New to AI terminology? Visit the AI Buzz AI Glossary — 100+ essential AI terms explained in plain English, each linking to a full in-depth guide.
🏦 1. What Is AI Model Risk Management? The SR 26-2 Framework Explained
Model risk management (MRM) is the organizational discipline that governs how financial institutions develop, validate, monitor, and retire the quantitative models that drive their most consequential decisions — credit approvals, fraud detection, capital calculations, stress testing, regulatory reporting, and BSA/AML compliance. The core premise of MRM is that models are inherently imperfect — they are built on assumptions, trained on historical data, and applied in conditions that may differ from those they were designed for. Model risk is the potential for adverse financial, operational, or regulatory consequences when those imperfections cause a model to produce incorrect, biased, or unstable outputs.
The SR 26-2 definition of model risk: Model risk is the potential for adverse consequences from decisions based on incorrect or misused model outputs. SR 26-2 defines model risk magnitude as a function of four components: inherent risk (the uncertainty in the model’s methodology and data), exposure (how significantly business decisions depend on model outputs), purpose (whether the model supports regulatory requirements or financial risk management), and materiality (the combination of exposure and purpose that determines governance intensity). Immaterial models require identification and performance monitoring only. Material models warrant comprehensive, rigorous oversight. The line between them is now explicit rather than implied.
SR 26-2 is the revised guidance on model risk management — the new baseline framework governing how banking organizations identify, validate, and oversee the quantitative models they rely on for credit decisions, regulatory reporting, capital calculations, stress testing, and more, issued jointly on April 17, 2026, by the Federal Reserve, the OCC, and the FDIC. SR 26-2 supersedes and replaces SR 11-7 and SR 21-8. The revision keeps the core disciplines of sound model risk management but makes the program more explicitly risk-based, proportionate, and tailored to a banking organization’s model profile, size, complexity, and risk.
SR 26-2 excludes “simple arithmetic calculations, such as those found within spreadsheets, as well as deterministic rule-based processes and software” from the definition of a model. The definition itself adds the word “complex” and requires the system to apply statistical, economic, or financial theory. This is a significant operational clarification — it settles the long-running debate about whether transaction monitoring rules, scoring tables, and expert-judgment frameworks constitute models for MRM purposes. Under SR 26-2, they generally do not, freeing governance resources to concentrate on the systems that carry genuine model risk. For financial institutions building an AI governance program alongside their MRM program, the foundational governance structure — inventory, risk classification, documentation, monitoring, and incident response — is covered in our AI Governance 101 guide.
📊 2. SR 26-2 vs SR 11-7: What Actually Changed for Banking AI
The shift from SR 11-7 to SR 26-2 is not a loosening of model risk standards. It is, as one practitioner framing put it precisely, a transfer of responsibility — from regulators who defined the procedure to institutions that must now demonstrate the judgment. SR 11-7 ran about 20 pages of dense, prescriptive expectations. SR 26-2 is roughly half the length and reads differently. The introductory letter states directly that the guidance does not set forth enforceable standards or prescriptive requirements, and that non-compliance will not, on its own, result in supervisory criticism. But that non-binding framing is not a signal of reduced supervisory interest — it is a recalibration of how that interest is expressed. The shift from SR 11-7 to SR 26-2 is not a loosening of standards. It is a transfer of responsibility.
The five most operationally significant changes are: the model definition narrowed; annual revalidation cycles replaced with risk-based cadence; independence redefined by rigor rather than org chart position; third-party model accountability strengthened; and generative and agentic AI explicitly excluded from scope. The table below maps the full comparison across all critical dimensions.
| Dimension | SR 11-7 (2011 — Retired) | SR 26-2 (April 2026 — Current) |
|---|---|---|
| Governance approach | Uniform rigor across all models regardless of risk level | Risk-based, tiered by materiality — proportionate to institution’s size, complexity, and model risk profile |
| Model definition | Broad — included many rule-based tools, spreadsheets, expert-judgment approaches | Narrowed to complex quantitative methods using statistical, economic, or financial theories producing quantitative output. Spreadsheets and deterministic rule-based processes excluded. |
| Validation cadence | Annual revalidation — interpreted as a default across all materiality levels | Risk-based cadence — revalidation frequency is a function of model materiality, change velocity, and data availability. No default annual cycle. |
| Validator independence | Structural independence required — separate reporting lines between developers and validators | “Quality of validation process depends on rigor and effectiveness of review rather than on organizational structure.” Independence is a function of review quality, not reporting line. |
| Third-party models | Limited guidance — vendor attestations were widely accepted as satisfying oversight requirements | Full accountability — institutions cannot transfer risk to a vendor by sourcing a model externally. Vendor attestations do not satisfy validation obligations. Oversight follows the use case. |
| Explainability | Implicit — models were assumed interpretable through mathematical structure | Explicit requirement — institutions must document how AI outputs are explained to decision-makers and affected parties, even when the model mechanism resists direct interpretation |
| Institutional scope | Broadly applied to all supervised institutions regardless of size | Explicitly tailored to banking organizations with more than $30 billion in total assets. Smaller institutions in scope only when model use is significant or activities fall outside traditional community banking. |
| Generative and agentic AI | Not addressed — did not exist as a mainstream banking technology in 2011 | Explicitly excluded from MRM scope. Banks must govern these systems through dedicated AI governance programs — not through the SR 26-2 model risk framework. Separate RFI signalled. |
| Binding status | Treated as de facto binding — deviations triggered MRAs and ratings downgrades. 2019 GAO ruling classified it as a rule under the Congressional Review Act. | Explicitly non-binding — principles-based guidance. Non-compliance with the text itself will not, on its own, result in supervisory criticism. Rigor must be demonstrated through institutional judgment. |
SR 11-7 was formally superseded and retired on April 17, 2026. SR 26-2 also simultaneously supersedes SR 21-8. Institutions describing their MRM program as “SR 11-7 compliant” are referencing a retired standard — update all internal documentation, vendor RFPs, and examiner-facing materials to reference SR 26-2.
⚠️ 3. The SR 26-2 Governance Gap: What the Framework Deliberately Excludes
The most operationally significant aspect of SR 26-2 — and the one most frequently underestimated in initial compliance reviews — is what it explicitly does not cover. The scope footnote is where the guidance draws its line: it states that generative AI and agentic AI models are novel and rapidly evolving, and as a result are not within the scope of the guidance. This is not an oversight. It is a deliberate regulatory choice, with the agencies signalling that a separate request for information on generative and agentic AI governance is forthcoming.
The practical consequence is a structural governance gap that every bank deploying large language models, AI copilots, or autonomous agents in customer-facing or internal workflows must actively close. The most significant gap is that generative and agentic AI — the systems banks are deploying most aggressively — fall entirely outside SR 26-2, the federal model risk management framework. Banks can deploy large language models and autonomous AI agents in credit decisions and customer service without satisfying the validation, documentation, and independent review requirements that apply to their traditional credit models. This does not mean those systems are ungoverned — it means the institution is responsible for designing the governance framework, not the regulator.
The two-track governance requirement for banks in 2026: Track 1 — SR 26-2 MRM program: applies to traditional statistical and quantitative models and non-generative, non-agentic AI that meets the institution’s model definition (credit scoring ML models, gradient-boosted classifiers, neural networks for fraud, BSA/AML transaction monitoring AI). Track 2 — Dedicated AI governance program: applies to generative AI, agentic AI, LLM-based copilots, and any AI system that does not meet the SR 26-2 model definition. Banks must route each system to the right governance track — an AI inventory that identifies the technology type is the operational mechanism for maintaining this split.
SR 26-2 does not mean banks can ignore governance for GenAI and agentic AI. The guidance states clearly that a bank’s existing risk management principles — materiality, ongoing monitoring, effective challenge — should guide governance for any tools and systems outside this document’s scope. The four SR 26-2 principles that apply defensibly to GenAI and agentic AI governance, even outside the formal MRM framework, are: inventory (every AI system catalogued with ownership assigned), pre-use validation (testing before deployment even without formal independent validation requirements), outcome monitoring (continuous performance tracking), and effective challenge (independent review that can drive change). For the AI governance program structure that addresses Track 2 for banks, see our AI Governance 101 guide. For the non-human identity and access controls that apply specifically to agentic AI in banking environments, see our Non-Human Identity guide. At the network and infrastructure layer, zero trust security architecture provides the enforcement mechanism for restricting how AI agents access internal systems, APIs, and data stores — a critical control for banks deploying autonomous AI in sensitive workflows. For the complete governance framework covering agentic AI controls, oversight structures, and accountability requirements in financial services and enterprise environments, see our Agentic AI Governance guide.
📋 4. Model Inventory and Tiering: How to Classify AI Models Under SR 26-2
The model inventory is the operational foundation of the SR 26-2 framework — without it, proportionality cannot be applied, validation cannot be prioritized, and monitoring cannot be scoped. SR 26-2 requires banks to maintain a documented, defensible model risk management program built around a model inventory, independent validation before and periodically after deployment, clearly documented assumptions and limitations, and ongoing monitoring for performance drift. The inventory must distinguish between in-scope SR 26-2 models and out-of-scope GenAI/agentic systems — routing each to the appropriate governance track rather than assuming one policy covers everything.
SR 26-2 explicitly guides institutions to use risk-based and tailored approaches to MRM. The expectation becomes the implementation of practices commensurate with each organization’s model risk profile, model materiality, and operating complexity. In practice, this means every model in the inventory must be classified by a materiality tier that determines the governance intensity applied to it. The tiering framework below reflects the SR 26-2 four-component risk magnitude structure and maps to how leading institutions are operationalizing the guidance in 2026.
| Model Tier | Materiality Criteria | Examples | SR 26-2 Governance Requirements |
|---|---|---|---|
| Tier 1 — Material | High exposure + regulatory / financial risk purpose. Model outputs directly drive consequential decisions affecting capital, regulatory reporting, or individual credit outcomes. | Credit scoring ML models, stress testing models, DFAST/CCAR capital models, BSA/AML transaction monitoring AI, fraud detection in credit decisions | Full independent validation before deployment (MRM validator group approval required). Risk-based revalidation cadence with defined triggers. Comprehensive documentation: conceptual soundness, outcome analysis, benchmarking. Ongoing monitoring with escalation thresholds. 10-year record retention. Board-level reporting. |
| Tier 2 — Standard | Moderate exposure + operational / business risk purpose. Model outputs influence significant decisions but are not the primary input to regulatory reporting or capital calculations. | Customer segmentation models, operational risk models, pricing optimization AI, non-regulatory AML monitoring models | Team lead plus MRM validator approval for production. Lighter independent review — rigor scaled to risk. Performance monitoring with defined review frequency. Documentation requirements proportionate to materiality. |
| Tier 3 — Immaterial | Low exposure + low-stakes purpose. Model outputs used as inputs to decisions with limited financial or regulatory consequence. | Internal reporting models, marketing propensity scores, low-stakes operational efficiency models | Identification and registration in inventory. Performance monitoring only — no comprehensive validation required. Re-tier trigger if use case or exposure increases. |
| Out of Scope — GenAI / Agentic Track | Does not meet SR 26-2 model definition OR is explicitly generative or agentic in architecture. Not governed under SR 26-2 MRM framework. | LLM-based customer service copilots, AI document summarization tools, autonomous trading agents, generative AI for compliance drafting | Governed through dedicated enterprise AI governance program — not MRM. Inventory registration required. Governance principles borrowed from SR 26-2 (inventory, pre-use validation, outcome monitoring, effective challenge) applied through AI governance framework. |
Tiering criteria as operationalized from SR 26-2 risk magnitude framework (April 2026). Institutions should expect 10–30% of legacy models to shift tier during re-tiering exercises under the new materiality definitions — most downward, with upward adjustments for regulatory reporting and BSA/AML uses. ⚠️ Do not cite SR 11-7 or SR 21-8 in any internal or examiner-facing documentation — both have been formally superseded.
What belongs in each inventory record for SR 26-2 compliance: model name and version, vendor or internal developer, use case and business line, model type (statistical, ML, neural network, or GenAI/agentic — for routing purposes), data inputs and training data provenance, materiality tier with rationale, current governance status (pre-validation / approved / monitoring / pending re-tiering), named model owner, date of last independent validation, next scheduled review trigger, and outstanding issues or exceptions. Traditional statistical and quantitative models, along with non-generative and non-agentic AI that meet the institution’s model definition, remain within the model risk framework. An AI inventory should therefore identify the technology type and route each use to the right governance path rather than assuming one policy covers everything. For the broader AI inventory methodology that covers both SR 26-2 in-scope models and GenAI/agentic systems, see our AI Risk Assessment guide.
🔍 5. Model Validation Requirements: Independent Review, Testing, and Documentation
Independent validation is the governance control that SR 26-2 most emphatically preserves from its predecessor. Effective challenge — the principle that models must be critically reviewed by experts with the independence, expertise, and organizational standing to drive change — remains the core governance principle. What changed is how independence is defined and what validation must produce.
SR 11-7 was read by most banks as requiring structural independence between model developers and validators, which in practice meant separate reporting lines. SR 26-2 states directly that “the quality of validation process depends on the rigor and effectiveness of the review rather than on organizational structure.” This is a significant operational flexibility — it means smaller institutions without large separate validation teams can achieve compliant effective challenge through rigor, not through bureaucratic structure. But it also raises the bar for what “rigor” means: validation findings must be documented in a way that demonstrates genuine challenge, not procedural sign-off. Institutions cannot transfer risk to a vendor by sourcing an AI model instead of building one. SR 26-2 makes clear that oversight obligations follow the use case, not the origin of the model. For model risk validators and governance leads who need to understand the neural network architectures underlying the AI credit and fraud models they are charged with validating — including how deep learning models learn, what makes them capable of pattern recognition in financial data, and what their inherent architectural limitations are — see our guide to what a neural network is.
The three validation pillars from SR 11-7 are preserved in SR 26-2 and remain the structural framework for all material model validation:
| Validation Pillar | What It Requires | SR 26-2 Updates / AI-Specific Additions |
|---|---|---|
| Conceptual Soundness | Assessment of whether the model’s theoretical foundation, design choices, and assumptions are appropriate for the intended use case | For ML and AI models: validator must assess training data quality, feature selection rationale, potential for bias in model design, and whether the algorithm is appropriate for the decision context — not just mathematical correctness |
| Outcome Analysis | Testing of model performance against observed outcomes — backtesting, benchmarking against challenger models, sensitivity analysis | SR 26-2 strengthens continuous monitoring expectations — outcome analysis is not a one-time validation event but an ongoing obligation tied to model materiality and change velocity. Fairness and bias outcome analysis added for AI credit models. |
| Ongoing Monitoring | Post-deployment tracking of model performance, stability, and data drift to detect degradation before it affects business decisions | Annual revalidation cycle replaced with trigger-based review: revalidation required when model materially changes, when performance metrics breach defined thresholds, or when the business environment shifts significantly from training conditions |
Documentation is where SR 26-2 compliance is most frequently found deficient in practice. A dashboard without escalation, issue management, remediation, and closure evidence is reporting, not a complete control. Every Tier 1 and Tier 2 model must have a validation report that documents: the scope of the review, the methods used, findings and exceptions, the validator’s assessment of model limitations, any conditions on approved use, and the sign-off authority. Vendor-provided models require the same documentation standard — a vendor’s own testing report or attestation does not satisfy the institution’s independent validation obligation under SR 26-2. For the AI incident response process that integrates with model risk management when a model failure occurs, see our AI Incident Response Playbook.
6. Ongoing Monitoring: Managing Risk After Deployment
Unlike traditional software, AI models are “living” entities. Their performance degrades over time as the real-world data they encounter diverges from their training set—a phenomenon known as model drift. Risk management does not end at the “Go-Live” date; it requires continuous, automated oversight.
The Three Dimensions of Post-Deployment Monitoring
- Data Drift: Monitoring changes in the input data distributions (e.g., a shift in customer demographics or economic conditions that makes the model’s original training data obsolete).
- Concept Drift: Monitoring changes in the relationship between input variables and the target outcome (e.g., a fraud detection model failing because scammers have adopted entirely new tactics).
- Performance Decay: Tracking hard metrics like precision, recall, and F1 scores in real-time to trigger automated alerts when the model falls below established risk thresholds.
For high-risk models, organizations should implement automated “circuit breakers” that can take a model offline or revert to a human-in-the-loop fallback if drift exceeds a specific tolerance level. For the continuous monitoring infrastructure that tracks these signals across your entire AI portfolio in real time — not just individual models — see our guide to AI Security Posture Management (AI‑SPM), which covers the tooling, dashboards, and alert frameworks that operationalize post-deployment risk visibility at the enterprise level.
7. Regulatory Alignment: SR 26-2, EU AI Act, and ISO 42001
AI model risk management is no longer just a best practice; it is a legal and regulatory requirement. Depending on your industry and geography, your MRM framework must map to specific standards to ensure compliance.
| Regulation / Standard | Primary Focus | Key MRM Requirement |
|---|---|---|
| SR 26-2 (Fed/OCC/FDIC) | US Banking & Finance | Risk-based validation cadence; narrowed model definition; explicit exclusion of Agentic AI from traditional MRM scope (Footnote 3). |
| EU AI Act | EU Market (Horizontal) | Mandatory risk management systems for “High-Risk” AI; transparency for GenAI; strict data governance and accuracy requirements. |
| ISO/IEC 42001 | Global Enterprise | International standard for AI Management Systems (AIMS); focuses on continuous improvement and systematic risk assessment. |
| NIST AI RMF v1.0 | Voluntary / Federal (US) | The “Govern, Map, Measure, Manage” functions; provides the methodology for identifying and mitigating socio-technical risks. |
Adopting a “Compliance-by-Design” approach—where these regulatory requirements are embedded into the MRM workflow from the start—is significantly more cost-effective than attempting to retrofit controls after a model has been built. For the complete plain-English implementation guide to NIST AI RMF 1.0 — including how the GOVERN, MAP, MEASURE, and MANAGE functions map to your MRM program’s governance, inventory, validation, and monitoring obligations, and how to apply the GenAI Profile to the LLM and agentic systems that SR 26-2 explicitly excludes — see our guide to the NIST AI Risk Management Framework.
Key Takeaways: A Practical AI Model Risk Management Framework
| MRM Pillar | What “Good” Looks Like | Why It Matters |
|---|---|---|
| Governance | Clear ownership, risk tiering, standardized documentation, executive oversight. | Prevents shadow models and ensures accountability. |
| Inventory & Tiering | A living model registry with tier-based controls and approval workflows. | You can’t manage what you can’t see. Enables risk-based prioritization. |
| Validation | Independent review of conceptual soundness, data quality, performance, and robustness. | Reduces model failures and supports regulatory defensibility. |
| Ongoing Monitoring | Automated drift detection, performance tracking, circuit breakers, and retraining triggers. | Detects decay early and prevents silent harm. |
| Regulatory Alignment | Mapped controls to SR 26-2, EU AI Act, ISO 42001, and NIST AI RMF v1.0. | Ensures compliance and avoids costly retrofits. |
Related Articles
- Zero Trust Security: A Practical Guide for AI Systems, APIs, and Agent Access
- Non-Human Identity (NHI) for AI Agents: What It Is + How to Implement It
- Agentic AI Governance: Policies, Controls, and Best Practices for Autonomous Agents
- OWASP Top 10 for Agentic Applications (2026): Risks + Security Controls
- The AI Audit Checklist: 80+ Questions to Vet Models, Vendors, and Risk Controls
FAQs
Q1: What is SR 26-2 and what does it replace?
SR 26-2 is the revised US interagency guidance on model risk management, issued jointly by the Federal Reserve, OCC, and FDIC on April 17, 2026. It fully supersedes and replaces SR 11-7 (2011) and SR 21-8 (2021). SR 11-7 is now retired — institutions should not cite it as a current standard in internal documentation, vendor RFPs, or examiner-facing materials. See our AI Governance 101 guide for the broader governance framework that sits alongside SR 26-2 compliance.
Q2: Does SR 26-2 apply to generative AI and AI agents?
No — SR 26-2 explicitly excludes generative AI and agentic AI from its scope, stating they are “novel and rapidly evolving” and not within the model risk guidance. However, these systems still require governance. Banks must build a dedicated enterprise AI governance program for GenAI and agentic AI, applying SR 26-2 principles (inventory, pre-use validation, outcome monitoring, effective challenge) through that separate framework. A separate regulator RFI on GenAI governance is expected.
Q3: Who does SR 26-2 apply to?
SR 26-2 is primarily tailored to banking organizations with more than $30 billion in total assets regulated by the Federal Reserve, OCC, or FDIC. Smaller institutions are generally out of scope unless their model footprint is unusually complex or their activities fall outside traditional community banking. All institutions should verify their specific applicability with qualified legal counsel — scope depends on both asset size and model risk profile.
Q4: What is the biggest operational change from SR 11-7 to SR 26-2?
The biggest single operational change is the end of the default annual revalidation cycle. SR 26-2 replaces it with a risk-based cadence where revalidation frequency is a function of model materiality, change velocity, and data availability. Banks running re-tiering exercises should expect 10–30% of legacy models to shift tier under the new materiality definitions — mostly downward. The second major change is that validator independence is now defined by rigor and review quality, not by structural reporting line separation.
Q5: How does SR 26-2 interact with EU AI Act requirements for banks?
For global banks, SR 26-2 and the EU AI Act create overlapping obligations for credit scoring, fraud detection, and underwriting AI — all classified as Annex III high-risk under the EU AI Act. SR 26-2 requires model inventory, independent validation, and ongoing monitoring. The EU AI Act adds conformity assessment, technical documentation, human oversight (Art. 14), and AI literacy training (Art. 4). ISO 42001 provides the most efficient documentation foundation — build the evidence library once and map to both frameworks, rather than maintaining separate compliance programmes. See our EU AI Act guide for the full compliance breakdown.
📧 Get the AI Buzz Weekly Digest
Weekly AI insights, tools, and strategies — delivered every Monday. Free.
Leave a Reply