How to Choose an AI Governance Consulting Firm for Banks

On April 17, 2026, the OCC, Federal Reserve, and FDIC jointly issued revised model risk management guidance (OCC Bulletin 2026-13), rescinding the Comptroller's Handbook's Model Risk Management booklet along with OCC Bulletins 1997-24, 2011-12, and 2021-19, the issuances that implemented SR 11-7 for OCC-supervised banks. The revised guidance moves to a more flexible, risk-based approach rather than a single prescriptive framework, and applies most directly to banking organizations with over $30 billion in total assets, though the agencies note it can also matter for smaller institutions with material model risk exposure. A firm should be able to tell you plainly whether your bank sits inside that scope and what the risk-based approach actually changes for your existing model inventory, not just repeat that SR 11-7 was replaced.

Most banks buy AI capability from a vendor rather than building it from scratch, which puts that relationship inside the OCC, Federal Reserve, and FDIC's June 2023 interagency guidance on third-party relationships (OCC Bulletin 2023-17), which replaced each agency's separate prior guidance with one risk-based lifecycle: planning, due diligence, contract negotiation, ongoing monitoring, and termination. A qualified firm should show how it maps an AI vendor engagement to that lifecycle specifically, including what ongoing monitoring looks like once the model is in production, not just confirm the guidance exists.

The April 2026 guidance explicitly excludes generative AI and agentic AI models, calling them "novel and rapidly evolving," and the agencies have signaled a forthcoming request for information on how model risk management should apply to them; Federal Reserve Vice Chair for Supervision Michelle Bowman has separately called for assessing whether existing supervisory guidance is fit for AI at all. In practice that means a bank's own generative or agentic AI use sits without a settled supervisory floor right now. A firm worth hiring builds governance for those systems voluntarily, drift monitoring, output review, escalation paths, rather than waiting for the RFI to resolve while that exposure sits ungoverned.

Writing a governance framework document is the easier half of the engagement. The harder half is building the monitoring, documentation, and escalation controls into a running system your examiners can actually inspect. Ask whether the firm's team includes engineers who build those controls, not only consultants who advise on them.