Banking and Financial Services
What Is AI Model Risk Management for Banks?
The guidance sounds like it covers every AI model a bank runs. The regulators who wrote it say otherwise, and the difference changes what a bank's model risk management program should cover.
AI model risk management for banks is the discipline of identifying, validating, and monitoring the AI and statistical models banks use for credit, fraud, and compliance decisions. The current model risk management guidance for banking organizations is SR 26-2, issued by the Federal Reserve, OCC, and FDIC in April 2026; it says generative AI and agentic AI models are not within its scope and is expected to be most relevant to banking organizations with more than $30 billion in total assets.
regulatory basis
SR 26-2: The Current Interagency Guidance
Bank model risk management has one real regulatory anchor. For fifteen years it was SR 11-7, the Federal Reserve's 2011 guidance on model risk. On April 17, 2026, the Federal Reserve, the OCC, and the FDIC jointly superseded it with SR 26-2, Revised Guidance on Model Risk Management, along with SR 21-8, the 2021 interagency guidance on anti-money-laundering models. If a vendor, a consultant, or an internal policy still points only to SR 11-7 as the current guidance, that citation is fifteen years out of date.
SR 26-2 is expected to be most relevant to banking organizations with more than $30 billion in total assets. Models used by banks at or below that threshold typically are subject to internal risk management and governance practices appropriate to their size and risk profile, and the agencies say excluding them from this specific guidance is consistent with a tailored supervisory approach, though a smaller bank with unusually complex or high-volume model use can still fall inside its relevance. The guidance is also explicit that it sets no enforceable standard: it is supervisory guidance, not a regulation, and non-compliance with this guidance will not result in supervisory criticism against a banking organization. That does not make its principles irrelevant: the guidance notes that supervisory action may still follow from violations of law or unsafe or unsound practices stemming from insufficient management of model risk.
scope
What Counts as a Model, and Why Generative AI Doesn't
The Guidance's Own Definition of a Model
SR 26-2 defines a model as a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to convert input data into quantitative estimates. That definition deliberately excludes simple spreadsheet arithmetic and deterministic, rule-based software with no underlying statistical or economic theory. A credit-scoring model, a fraud-detection classifier, or an anti-money-laundering alert engine built on statistical or machine-learning methods fits squarely inside that definition.
Generative AI and Agentic AI Are Explicitly Out of Scope
The guidance draws its most consequential line in a single footnote: generative AI and agentic AI models are described as novel and rapidly evolving, and the agencies state plainly that they are not within the scope of this guidance. A bank's large language model chatbot, an AI coding assistant, or an autonomous agent that takes multi-step actions does not fall within SR 26-2's scope as written today.
That does not mean generative and agentic AI are ungoverned. The same footnote says a banking organization's own risk management and governance practices should guide the determination of appropriate controls for any tool the guidance does not cover, and the core SR 26-2 principles, inventory, validation, monitoring, governance, are a natural starting point for building that internal coverage, even though the guidance itself does not cover these newer systems.
The Principles Still Apply to Vendor and Third-Party AI Models
For AI licensed from a vendor, SR 26-2 says that, even where a banking organization does not receive a vendor's underlying code, data, or methodology, the principles of model risk management remain applicable. The guidance describes validation of vendor products as an important element, including understanding their conceptual soundness, design, development data, and performance, and says sound practice involves ongoing monitoring and outcomes analysis to assess whether vendor models are accurate, remain fit for purpose, and continue to be reliable.
framework
The Core Components of a Bank AI Model Risk Management Program
1. Model Inventory
A comprehensive, maintained record of every model under development or in use, detailed enough to understand risk at both the individual model and portfolio level, not just a spreadsheet of names.
2. Independent Validation
A review function with sufficient independence from the team that built the model, evaluating conceptual soundness (design, assumptions, and data) and running outcomes analysis that compares model output against real-world results to catch drift or persistent errors.
3. Ongoing Monitoring
Continuous evaluation of whether a model still performs as expected as products, customer behavior, data, or market conditions shift, with a defined process for adjusting, recalibrating, or retiring a model that no longer holds up.
4. Governance, Roles, and Effective Challenge
Clear accountability for development, validation, and monitoring, with policies proportional to the bank's size and model complexity, and a genuine effective-challenge process with sufficient independence from the people who built the model.
5. Vendor and Third-Party Oversight
The same validation and monitoring discipline applied to purchased or licensed models, including documenting any customization made to fit the bank's specific use case.
6. Documentation
Records thorough enough to support continuity when staff turn over, track outstanding validation findings and remediation, and give an examiner a clear paper trail without reconstruction under deadline pressure.
differentiation
How Kriv AI Helps
Kriv AI works with banks and other regulated financial institutions to build or strengthen the AI model risk management program SR 26-2 describes: model inventory design, independent validation support, vendor model due diligence, and the governance documentation examiners may ask to see. This is advisory and implementation work, not a replacement for a bank's own model risk function.
Related resources
Continue exploring
Straight answers
Frequently asked questions about What Is AI Model Risk Management for Banks?
What is AI model risk management for banks?
AI model risk management for banks is the discipline of identifying, validating, and monitoring the AI and statistical models banks use for credit, fraud, and compliance decisions. The current model risk management guidance for banking organizations is SR 26-2, issued by the Federal Reserve, OCC, and FDIC in April 2026; it says generative AI and agentic AI models are not within its scope and is expected to be most relevant to banking organizations with more than $30 billion in total assets.
Does SR 26-2 cover generative AI or AI agents used by banks?
No. SR 26-2 states directly that generative AI and agentic AI models are novel and rapidly evolving and are not within the scope of the guidance. The guidance's principles apply to traditional statistical and quantitative models and non-generative, non-agentic AI models, such as statistical credit-scoring or fraud-detection models, at banking organizations within its scope.
Which banks does SR 26-2 apply to?
SR 26-2 is expected to be most relevant to banking organizations with more than $30 billion in total assets. For banking organizations with $30 billion or less, models typically are subject to internal risk management and governance practices appropriate to their size and risk profile, though the guidance may still be relevant where model risk exposure is significant because of the prevalence and complexity of their models or because of activities outside the scope of traditional community banking.
What did SR 26-2 replace?
SR 26-2, issued April 17, 2026 by the Federal Reserve, OCC, and FDIC, superseded SR 11-7 (the Federal Reserve's original 2011 model risk management guidance) and SR 21-8 (the 2021 interagency guidance on anti-money-laundering models).
What are the core components of a bank AI model risk management program?
A model inventory, independent validation covering conceptual soundness and outcomes analysis, ongoing monitoring, clear governance with effective challenge, oversight of vendor and third-party models, and documentation thorough enough that it does not have to be reconstructed under deadline pressure.
How does Kriv AI help banks with AI model risk management?
Kriv AI builds and strengthens AI model risk management programs for banks: model inventory design, independent validation support, vendor model due diligence, and governance documentation.
Talk to the team that would do the work
Bring your requirements to a working session with the person who'll actually deliver.
Book a Discovery Call