SR 11-7 was the Federal Reserve's guidance on model risk management, issued with the OCC in April 2011. For fifteen years it set the expectations US banks followed for building, validating and governing models. On April 17, 2026, the Federal Reserve, the OCC and the FDIC replaced it with SR 26-2, revised interagency guidance on model risk management. This guide explains what SR 11-7 asked for, what SR 26-2 kept and changed, and what the change means for AI models, including the generative and agentic AI that SR 26-2 places outside its scope. It is part of our Agentic AI Governance & Model Risk series.
What SR 11-7 was
SR 11-7 defined a model as a quantitative method, system or approach that applies statistical, economic, financial or mathematical theories to turn input data into quantitative estimates. It described three parts of every model: the information input, the processing that turns inputs into estimates, and the reporting that turns estimates into business information.
It named two sources of model risk. The first was fundamental errors that make a model's outputs wrong. The second was incorrect or inappropriate use, including using a model outside the conditions it was built for.
The guidance rested on three pillars:
- Model development, implementation and use: a clear purpose, sound design, tested data and documented limitations.
- Model validation: evaluating conceptual soundness, ongoing monitoring including process verification and benchmarking, and outcomes analysis including back-testing.
- Governance, policies and controls: board and senior management accountability, written policies, a firm-wide model inventory, documentation, and internal audit of the whole framework.
Running through all three was effective challenge: critical analysis by objective, informed people with the competence, incentives and influence to make developers change a model. SR 11-7 also expected validation to be performed, in general, by people who did not build or use the model and had no stake in its outcome.
Vendor models were in scope. Banks were expected to validate their own use of a vendor product even without access to its code, and to keep contingency plans if the vendor stopped supporting it.
The FDIC adopted SR 11-7 for the banks it supervises in 2017. In 2021, the agencies added SR 21-8, an interagency statement on applying model risk management to systems that support Bank Secrecy Act and anti-money laundering compliance.
SR 11-7 is no longer current. Policies and procedures that still cite it should be updated to SR 26-2.
What SR 26-2 is
SR 26-2 is a supervisory letter dated April 17, 2026, issued by the Federal Reserve, the OCC and the FDIC together. It supersedes both SR 11-7 and SR 21-8. The OCC issued the same guidance as Bulletin 2026-13, rescinding Bulletin 2011-12, Bulletin 2021-19 (its version of the BSA/AML statement), Bulletin 1997-24 on credit scoring models, and the Model Risk Management booklet of the Comptroller's Handbook. The FDIC issued it as FIL-15-2026.
The agencies describe the revision as reflecting fifteen years of supervisory experience and industry feedback, and advances in modeling practice. The central theme is a risk-based approach tailored to each banking organization's model risk profile, size and complexity.
The guidance has seven sections: an introduction; purpose and scope; an overview of model risk and model risk management; model development and model use; model validation and monitoring; governance and controls; and vendor and other third-party products.
Three points about its status and reach matter for planning:
- It is guidance. The attachment states that it does not set out enforceable standards or prescriptive requirements, and that falling short of it will not by itself bring supervisory criticism. A footnote adds that supervisory action may still follow from violations of law or unsafe or unsound practices that stem from weak model risk management.
- It is expected to be most relevant to banking organizations with more than $30 billion in total assets. Models at smaller organizations are typically governed by internal practices suited to their size and risk profile, though the guidance may still be relevant where a smaller organization has significant exposure to model risk.
- Generative AI and agentic AI models are out of scope. The guidance covers traditional statistical and quantitative models and non-generative, non-agentic AI models.
SR 11-7 vs SR 26-2 compared
| SR 11-7 (2011, superseded) | SR 26-2 (2026, current) | |
|---|---|---|
| Issued by | Federal Reserve with the OCC; adopted by the FDIC in 2017 | Federal Reserve, OCC and FDIC |
| Status | Supervisory guidance | Supervisory guidance; states it sets no enforceable standards or prescriptive requirements |
| Who it is for | All banking organizations supervised by the Federal Reserve, scaled to size and complexity | Most relevant to banking organizations over $30 billion in total assets |
| Model definition | Quantitative method that turns inputs into estimates, with input, processing and reporting components | A complex quantitative method; explicitly excludes simple arithmetic and deterministic rule-based processes |
| Approach | Comprehensive framework applied across all models | Risk-based and tailored; materiality set by model purpose together with model exposure, and overall model risk set by inherent risk in the context of materiality |
| Validation independence | Generally performed by people separate from development and use | Judged by the rigor and effectiveness of the review rather than organizational structure, with conflicts of interest addressed |
| BSA/AML systems | Addressed separately in SR 21-8 | SR 21-8 superseded; covered within the same guidance |
| AI | Not addressed directly | Non-generative, non-agentic AI in scope; generative and agentic AI out of scope |
| Vendor models | Validate the bank's use, contingency plans | Same principles; proprietary limits on code or data do not change them |
| Effective challenge | Central concept | Retained: critical analysis by objective experts who evaluate model risk and drive appropriate changes across the model lifecycle |
The structure is familiar. Banks with a mature SR 11-7 program will find most of it maps directly. The changes are in emphasis: tiering by materiality, less rigid reading of validation independence, one framework for BSA/AML systems, and a clear boundary around generative and agentic AI.
What SR 26-2 means for AI models
For machine learning models, the answer is straightforward. A gradient-boosted credit model, a fraud score or a transaction monitoring model built with machine learning is a non-generative AI model. It sits inside SR 26-2 and gets the same development, validation and governance as any other model, scaled to its materiality.
Generative and agentic AI are different. SR 26-2 calls them novel and rapidly evolving and places them outside its scope, while noting that a bank's governance should still guide the controls around such tools. That does not mean they are unregulated or unexamined. It means the model risk guidance does not tell you how to govern them, so you need another framework.
Most banks fill that gap with three things. First, the same inventory and accountability they use for models, extended to generative tools and agents. Second, a recognized framework for AI risk, most often the NIST AI RMF and its Generative AI Profile; our guide to the NIST AI RMF and the Generative AI Profile explains how to map controls to it. Third, runtime controls for agents that act: their own identity, enforced access, decision logs and a way to stop them. Our guide to prompt injection controls for AI agents covers those controls in detail.
The boundary is not meant to be permanent. When they issued the guidance, the agencies said they plan to issue a request for information on model risk management, including banks' use of AI, generative AI and agentic AI. Expect examiners to ask how generative and agentic AI are governed in the meantime, even though SR 26-2 does not cover them. "Out of scope of the model risk guidance" is a reason to have a separate, documented approach, not a reason to have none.
How to update a model risk program for SR 26-2
- Replace references. Update policies, procedures, validation templates and board reports that cite SR 11-7 or SR 21-8.
- Re-baseline the model definition. SR 26-2 defines a model as a complex quantitative method, and excludes simple arithmetic and deterministic rule-based processes. Apply that to the inventory. Some spreadsheet calculations and rule-based tools may leave the model inventory; record them elsewhere with their own controls.
- Tier by materiality. Assign each model a materiality level based on its purpose and exposure, then assess its inherent risk within that tier. Scale development standards, validation depth and monitoring to the result. Keep monitoring immaterial models for changes that would raise their tier.
- Revisit validation independence. Document how validation stays rigorous and how conflicts of interest between development and validation are identified and managed, rather than relying on reporting lines alone.
- Bring BSA/AML systems into the main framework. Transaction monitoring, sanctions screening and customer risk models now sit under the same guidance as other models.
- Set up a separate track for generative and agentic AI. Inventory them, assign owners, adopt a framework such as the NIST AI RMF, and define runtime controls for agents.
- Report to the board in the new terms. Show model risk by materiality tier, in aggregate as well as model by model.
What examiners and auditors check
SR 26-2 is guidance, not a rule, but supervisors use it to assess model risk management, and weak model risk management can still lead to supervisory action as an unsafe or unsound practice. Expect requests like these:
- A model risk management policy that cites SR 26-2, approved at the right level and reviewed on a schedule.
- A complete model inventory with purpose, use, owner, materiality tier, validation status and known limitations for each model.
- A documented method for setting materiality from model purpose and exposure.
- Validation reports scaled to materiality, covering conceptual soundness, outcomes analysis and ongoing monitoring.
- Evidence of effective challenge: findings raised, and changes made because of them.
- How validation independence and conflicts of interest are handled.
- Vendor model validation, including how the bank tests a model it cannot see inside.
- BSA/AML models covered by the same framework, with validation records.
- A separate, documented approach for generative and agentic AI, with an inventory and controls.
- Internal audit's assessment of the overall framework.
- Board and senior management reporting on model risk, individually and in aggregate.
If you are not a bank
SR 26-2 applies to banking organizations. If you work in insurance, healthcare or another industry, the same questions still apply to your models and AI, and the NIST AI RMF is the more common reference. Our AI governance consulting covers regulated enterprises outside banking.
When to bring in a partner
The guidance change is moderate. The work it triggers is not: re-baselining the inventory, building materiality tiers, folding BSA/AML systems in, and standing up governance for generative and agentic AI that the guidance leaves to you. Duczer East provides AI governance and model risk consulting for banks, from the SR 26-2 gap analysis to validation and the controls for AI agents.
