%20rotate(-180)'%20xlink:href='%23linear-gradient'%3e%3c/linearGradient%3e%3clinearGradient%20id='linear-gradient3'%20x1='841.45'%20y1='247.11'%20x2='3086.34'%20y2='247.11'%20gradientTransform='translate(4479.33%203591.33)%20rotate(-180)'%20xlink:href='%23linear-gradient'%3e%3c/linearGradient%3e%3c/defs%3e%3cg%20id='Z'%3e%3cpath%20id='_x31_'%20fill='url(%23linear-gradient)'%20d='M2695.1,484.18c20.1,19.58,37.87,42.03,52.67,67.11,57.79,97.91,59.52,215.79,4.58,315.34l-992.94,1799.47h200.21c274.56,0,527.42-149.27,660.07-389.66l989.02-1792.26h-913.62Z'%3e%3c/path%3e%3cpath%20id='_x32_'%20fill='url(%23linear-gradient1)'%20d='M2674.21,823.5h0c84.15-152.48-26.15-339.33-200.31-339.33h-1275.39c-274.56,0-527.42,149.27-660.07,389.66l-80.32,145.55h2108l108.09-195.88Z'%3e%3c/path%3e%3cpath%20id='_x33_'%20fill='url(%23linear-gradient2)'%20d='M1400.9,3611.82c-20.1-19.58-37.87-42.03-52.67-67.11-57.79-97.91-59.52-215.79-4.58-315.34l992.94-1799.47h-200.21c-274.56,0-527.42,149.27-660.07,389.66l-989.02,1792.26h913.62Z'%3e%3c/path%3e%3cpath%20fill='url(%23linear-gradient3)'%20d='M1421.79,3272.5h0c-84.15,152.48,26.15,339.33,200.31,339.33h1275.39c274.56,0,527.42-149.27,660.07-389.66l80.32-145.55H1529.88l-108.09,195.88Z'%3e%3c/path%3e%3c/g%3e%3c/svg%3e)
On April 17 the Federal Reserve, OCC, and FDIC issued revised model risk management guidance (SR 26-2, OCC Bulletin 2026-13, FDIC FIL-15-2026). It supersedes SR 11-7, the 2011 document that governed bank model risk for fifteen years. The revision modernizes the framework for statistical and traditional AI models. Then it draws a line. Generative and agentic AI models are explicitly out of scope, described as too “novel and rapidly evolving” to govern in this document.
The agencies paired the carve-out with a promise. They said a request for information on model risk and banks’ use of AI, including generative and agentic AI, would come “in the near future.” As this edition went to press on August 8, no such RFI had been published. The result is a genuine vacuum. The fastest-moving model class in your institution is the one class your model-risk guidance now formally declines to cover.
The gap, precisely
| Model class | Governing framework |
|---|---|
| Traditional statistical & quantitative models | SR 26-2 (revised guidance) |
| Non-generative, non-agentic AI/ML | SR 26-2 (revised guidance) |
| Generative AI · agentic AI | Out of scope. RFI promised but not yet issued |
| AI vendors as third parties | Interagency TPRM guidance (unchanged since June 2023) |
A carve-out is not a safe harbor. The examiner who agrees your chatbot is outside SR 26-2 will still ask what does govern it, and “nothing” is the wrong answer.
Governing into the vacuum
Two anchors survive. The first is the third-party risk lens. The interagency guidance on third-party relationships has not changed since June 2023, and it still covers every GenAI vendor relationship. Inventory, diligence, and monitoring obligations stand regardless of the model-risk carve-out. The second is that nothing prevents you from applying SR 26-2’s own principles to GenAI voluntarily. That means an inventory entry, a documented validation approach sized to use-case risk, and defined ownership. Banks that do so now will have both a defensible exam answer and a ready-made RFI comment letter.
- State your GenAI governance position in writing. Say which framework you apply voluntarily, to which use cases, and who owns it.
- Keep GenAI tools in the model inventory even though SR 26-2 does not require it. The inventory is your exam answer.
- Pre-draft your RFI response now, while the pain points are fresh. The comment window will be short when it finally opens.
Zovos maintains your AI use-case inventory with each tool’s governance status, covering framework, validation state and owner. Your own documented policy fills the gap the guidance left.
This is for information only and is not legal advice. Confirm your obligations against the guidance text and counsel before acting.