The New Bank GuidanceLeaves Generative AI to You

For fifteen years, SR 11-7 was the reference point for how US banks manage model risk. On April 17, 2026, the Federal Reserve, the OCC and the FDIC replaced it with new interagency guidance (SR 26-2, OCC Bulletin 2026-13, FDIC FIL-15-2026).

The most important change for AI is a single footnote.

What the guidance says about generative AI

The same footnote adds that banks should still apply their own risk management practices to systems the guidance does not cover. The principles do apply to traditional statistical and quantitative models and to non-generative, non-agentic AI. Neither "generative" nor "agentic" is defined, so each bank has to draw that line itself.

Why "out of scope" is not "unregulated"

Examiners will still ask how a bank controls the chatbot that answers customers, the copilot that drafts credit memos, or the agent that reconciles accounts. Without the guidance to point to, the answer has to come from the bank's own program, and that program has to be written down, owned and evidenced. Fair lending, consumer protection and third-party risk expectations apply whatever technology sits underneath.

Five steps to close the gap

1. Draw the line in writing. Define which systems the bank treats as generative or agentic, and record the reasoning. Examiners will look for a consistent rule, not case-by-case calls.
2. Inventory everything, in one place. Keep generative AI in the same inventory as traditional models, with owner, purpose, data, vendor and risk tier, even though different rules apply.
3. Adapt validation for generative AI. Replace classic back-testing with a fixed evaluation set, output checks against source data, and limits on what the system is allowed to do without a person.
4. Treat vendor models as third-party risk. Most bank generative AI comes from vendors. Contracts need testing evidence, change notices and limits on the use of bank data for training.
5. Keep fair lending in view. Any AI that influences credit decisions, including through summaries or recommendations, needs adverse action and disparate impact review.