On 17 April 2026 the Federal Reserve, OCC, and FDIC issued Supervisory Letter SR 26-2. It is active joint interagency guidance. It permanently replaces the fifteen-year SR 11-7 framework (and related SR 21-8 updates) as the governing model-risk expectation for supervised institutions.
What changed in the text
Three shifts matter for AI governance programmes:
- Non-binding framing - SR 26-2 is explicit guidance, not a rigid rulebook. Examiners still expect a defensible programme; the letter does not invent a new statute.
- Risk-based cadence - Strict annual revalidation cycles give way to reviews tied to risk and materiality.
- Scope definition - The definition of a model tightens while accounting better for modern AI and ML systems that change customer outcomes without looking like a classic scorecard.
From checklist to rationale
Supervisors spent a decade under SR 11-7 teaching banks how to inventory models, challenge them, and monitor drift. Generative and agentic systems stretch that vocabulary. They are not always scored like a credit model, yet they change customer outcomes, control environments, and audit trails.
The operating requirement under SR 26-2 is continuous documented rationale: why this system is in scope, who owns it, what evidence shows it remains fit for purpose, and how the bank would switch it off.
That matters because many deployments begin life as productivity tools outside the model inventory. Shadow SaaS copilots, vendor-embedded models, and agents with tool access all create outcomes that look like model risk without looking like a traditional scorecard.
What a control plane must capture
A bank that treats SR 26-2 as a documentation exercise will fail the next exam cycle. Encode the programme as:
- Scope - materiality and inventory that includes generative and agent systems
- Ownership - named accountable executives, not shared mailboxes
- Ongoing evidence - monitoring, overrides, incidents, and change history keyed to risk cadence
- Exit - kill switch and export of the supervisory pack
solvly reading
We encode those expectations as policy-as-code in the United States pack, mapped through Govern, Guard, Observe, and Respond. Observe mode is the on-ramp: capture the rationale trail before enforcement is switched on.
Instrument citation: Fed / OCC / FDIC Supervisory Letter SR 26-2, 17 April 2026. See the United States Jurisdiction Pack.