Regulayer™ / The 151 laws / Financial services
SR 26-2 / OCC Bulletin 2026-13
Model risk management. Supersedes SR 11-7 / OCC 2011-12.
Superseded on 17 April 2026.
Federal Reserve SR 26-2 and OCC Bulletin 2026-13 supersede and replace SR 11-7 (4 April 2011) and SR 21-8 (9 April 2021). Three points from the new text that change how this page should be read: the guidance is expressly non-enforceable, so non-compliance alone does not draw supervisory criticism; generative and agentic AI are outside its scope, and it reaches traditional statistical models and non-generative AI only; and it is stated to be most relevant to banking organisations with over $30 billion in total assets. Verified against the SR 26-2 attachment, 3 August 2026. The page below describes the superseded framework and is kept because the model-risk principles carried forward.
Model risk management.
What the signed record shows
The proof is a signed, tamper-evident record. Anyone can check it, without an account, and nothing has to leave the building to make it. Evidence, not a promise.
On generative and agentic AI. Footnote 3 of SR 26-2, verbatim: “Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance. Nonetheless, a banking organization’s risk management and governance practices should guide the determination of appropriate governance and controls for any tools, processes, or systems not covered in this document.” The systems that act are outside the guidance. The expectation that a bank controls them is not.
The request for information. On 17 April 2026 the agencies said they plan to issue “in the near future” a request for information that addresses model risk management generally and considers, in particular, banks’ use of AI, including generative AI and agentic AI. As at 7 September 2026 that request for information has not been issued. Until it is, a bank deploying agents works to its own practices, and the record it can produce for an agent’s action comes down to two facts: who authorised it, and whether a person outside the system can check that record. Footnote 3 read from the SR 26-2 attachment, 7 September 2026.
Citation: Development, validation, governance
In the same family
What to do about it
A signed record of which AI you used and what you checked, sealed to the exact file you deliver, made on your own machine and checkable free by anyone you send it to.
Part of the Regulayer™ proof catalogue: 151 laws and standards, one sealed engine. This page is a product description, not legal advice.