Updated 19 August 2026. SR 26-2 is non-binding by its own terms and assessed at examination. Calling it “explicit guidance” was being read as a Force claim. Force stays Supervisory expectation. The inventory now holds the predecessor chain the original note already cited.
On 17 April 2026 the Federal Reserve, OCC and FDIC issued Supervisory Letter SR 26-2. It is active joint interagency guidance. It permanently replaces SR 11-7 (and related SR 21-8 updates) as the governing model-risk expectation for supervised institutions. The 12 CFR basis is the Role of Supervisory Guidance rule: 12 CFR Part 4 Subpart F Appendix A (OCC), Part 262 Appendix A (Board) and Part 302 Appendix A (FDIC). That disclaimer is statutory boilerplate. It is not a reason to file SR 26-2 next to NIST AI RMF.
What changed in the text
Shifts that matter for AI governance programmes:
- Non-binding by its own terms, assessed at examination. The letter does not invent a new statute. Examiners still expect a defensible programme.
- Risk-based cadence. Strict annual revalidation cycles give way to reviews tied to risk and materiality.
- Scope definition. The definition of a model tightens while accounting better for modern AI and ML systems that change customer outcomes without looking like a classic scorecard.
- Footnote 3’s second clause. Generative and agentic AI “are not within the scope of this guidance.” Nonetheless, “a banking organization’s risk management and governance practices should guide the determination of appropriate governance and controls for any tools, processes, or systems not covered.” The carve-out is not a permission to run those tools without governance.
- The $30bn screen. The guidance is “expected to be most relevant” above $30 billion in total assets, “generally excluding” smaller organisations, except where they have significant model-risk exposure “because of the prevalence and complexity of their models or because of activities outside the scope of traditional community banking.”
- §III’s immaterial-model tier. Models deemed immaterial on exposure and purpose may be managed by identification plus monitoring for the point at which they become material. Higher-materiality models warrant more comprehensive oversight.
- Effective challenge carries over. Objective experts, sufficient independence and the standing to effect change, throughout the model lifecycle.
Three texts, seven citations
The agencies did not publish a joint rescission count. Each agency published its own list. FDIC two, OCC three, FRB two. That is seven rescinded issuances across three agencies, resolving to three underlying texts: SR 11-7 / OCC 2011-12 / FIL-22-2017, SR 21-8 / OCC 2021-19 / FIL-27-2021, and OCC Bulletin 1997-24. SR 26-2 itself names only the first two as superseded. 1997-24 was withdrawn on the same day with no successor named in that letter. Never present a total as agency-stated.
From checklist to rationale
Supervisors spent a decade under SR 11-7 teaching banks how to inventory models, challenge them and monitor drift. Generative and agentic systems stretch that vocabulary. They are not always scored like a credit model, yet they change customer outcomes, control environments and audit trails.
The operating requirement under SR 26-2 is continuous documented rationale: why this system is in scope, who owns it, what evidence shows it remains fit for purpose and how the bank would switch it off.
That matters because many deployments begin life as productivity tools outside the model inventory. Shadow SaaS copilots, vendor-embedded models and agents with tool access all create outcomes that look like model risk without looking like a traditional scorecard.
What a control plane must capture
A bank that treats SR 26-2 as a documentation exercise will fail the next exam cycle. Encode the programme as:
- Scope - materiality and inventory that includes generative and agent systems, using footnote 3’s second clause as the hook
- Ownership - named accountable executives, not shared mailboxes
- Ongoing evidence - monitoring, overrides, incidents and change history keyed to risk cadence
- Exit - kill switch and export of the supervisory pack
solvly reading
We encode those expectations as policy-as-code in the United States pack, mapped through Govern, Guard, Observe and Respond. Observe mode is the on-ramp: capture the rationale trail before enforcement is switched on.
Instrument citation: Fed / OCC / FDIC Supervisory Letter SR 26-2, 17 April 2026. See the United States Jurisdiction Pack. For how the US model definition sits against Canada and Korea, see Model risk: convergence on mechanism, divergence on boundary.