Bank AI Model Risk
What Is SR 11-7 and How Does It Apply to AI Models?
SR 11-7 is still the name most people search for, but it no longer stands on its own. Here is what it was, what replaced it, and where AI models fall under the replacement.
SR 11-7 is the Federal Reserve's April 2011 supervisory guidance on model risk management. In April 2026 the Federal Reserve, OCC, and FDIC replaced it with SR 26-2. The new guidance covers traditional statistical and non-generative AI models, and says generative and agentic AI are outside its scope. Kriv AI advises banks on applying it. Every engagement is scoped and priced after a short discovery call.
context
What SR 11-7 Was, and What Replaced It
SR 11-7 is a short name for a long-running idea: a bank that relies on models should manage the risk that those models are wrong or misused. The letter itself has been retired, but the idea carried forward.
SR 11-7 was a Federal Reserve supervisory letter
The Federal Reserve issued SR letter 11-7, titled "Guidance on Model Risk Management," on April 4, 2011. Supervisory letters of this kind tell Reserve Banks and the banks they supervise how examiners expect an issue to be handled. For fifteen years, "SR 11-7" was shorthand for model risk management in U.S. banking, and it became the reference point that internal audit teams, validators, and vendors measured their work against.
SR 26-2 supersedes it
On April 17, 2026, the Federal Reserve, the OCC, and the FDIC issued SR 26-2, "Revised Guidance on Model Risk Management." The Federal Reserve's letter states that the revised guidance "supersedes and replaces SR letter 11-7" as well as SR letter 21-8, the 2021 interagency statement on model risk for systems supporting Bank Secrecy Act and anti-money laundering compliance. If a policy, vendor contract, or examiner request cites SR 11-7 today, the current text to read is SR 26-2.
The agencies say the revision reflects "supervisory experience and industry feedback accumulated over the past fifteen years, as well as significant advancements in modeling practices," and that it emphasizes a risk-based approach tailored to a bank's model risk profile and the size and complexity of its operations.
It is guidance, not a rulebook
SR 26-2 states that it "does not set forth enforceable standards or prescriptive requirements; accordingly, non-compliance with this guidance will not result in supervisory criticism." A footnote adds that supervisory action may still follow "any violations of law or unsafe or unsound practices stemming from insufficient management of model risk." In practice that means a weak model risk program is not penalized for missing a checklist item, but it can still be criticized for the underlying unsafe practice. Your counsel and your regulator, not this page, decide what that means for your institution.
context
What Counts as a Model Under the Current Guidance
Whether SR 26-2 reaches an AI system depends first on whether the system is a model at all, and then on which kind of model it is.
The definition
SR 26-2 defines a model as "a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates." It excludes "simple arithmetic calculations, such as those found within spreadsheets, as well as deterministic rule-based processes and software where there are no statistical, economic, or financial theories underpinning their design or use."
A credit scoring model, a fraud detection classifier, or a loss forecast built with machine learning fits that definition. A fixed set of if-then rules does not.
Who the guidance is aimed at
The guidance is "expected to be most relevant to banking organizations with over $30 billion in total assets." It adds that models at banks with $30 billion or less "typically are subject to internal risk management and governance practices appropriate for the size and risk profile" of those banks, while noting the guidance may still be relevant where a smaller bank has significant exposure to model risk because of how many or how complex its models are.
Materiality sets the effort
The guidance ties the depth of oversight to model materiality, which it describes as the combination of model exposure and model purpose. A model deemed immaterial may need little more than being identified and monitored for the conditions under which it could become material. Models of higher materiality "warrant more comprehensive and rigorous oversight."
ai gap
How the Guidance Applies to AI Models
AI models are not one category under SR 26-2, and the guidance treats three groups differently.
The first group is traditional statistical and quantitative models and non-generative, non-agentic AI models. The guidance says its principles "apply to traditional statistical and quantitative models and non-generative, non-agentic AI models." A gradient boosting model that scores credit risk, a neural network that flags unusual transactions, and a time series model that forecasts deposits all sit here. For these, the full lifecycle applies: a clear statement of purpose, testing during development, independent validation, ongoing monitoring, and an entry in the model inventory.
The second group is generative AI and agentic AI. A footnote states these "are novel and rapidly evolving. As such, they are not within the scope of this guidance." That sentence is easy to misread as permission to skip governance. The same footnote continues: "a banking organization's risk management and governance practices should guide the determination of appropriate governance and controls for any tools, processes, or systems not covered in this document." In other words, the guidance does not tell you what to do for a large language model, but it does expect you to have a considered answer.
The third group is everything that is not really a model, such as a rules engine or a spreadsheet. These fall outside the definition, though a bank may still control them under other policies.
A practical consequence is that the same bank can have all three groups in one workflow. A loan decision might use a scored model (in scope), a language model that summarizes the applicant file (outside the formal scope), and a rules engine that applies policy limits (not a model). Governing the workflow means deciding how each part is controlled and how the parts interact. The guidance itself notes that sound practice involves assessing model risk both individually and in aggregate, including "interactions and dependencies among models."
capabilities
What SR 26-2 Expects, Applied to an AI Model
Inventory
The guidance says an effective model inventory "includes sufficient information to understand model risks," at both the individual and aggregate level. For AI, that means recording the model version, its training data lineage, who owns it, what decisions it informs, and whether any vendor supplies part of it.
Independent validation
Validation assesses conceptual soundness, outcomes analysis, and ongoing monitoring. The guidance notes that for some models, assessments "such as interpretability measures or benchmarking to other models" may be more practical than evaluating theoretical construction. That is a useful opening for machine learning models whose internal logic is hard to read directly.
Effective challenge
Effective challenge is critical analysis by objective experts with "sufficient independence to maintain objectivity" and "the organizational standing and influence to effect any change." For an AI model this means the person reviewing the model is not the person who built it and can actually stop a release.
Vendor and third-party models
The guidance states that for vendor products the principles of model risk management "remain applicable" even when the vendor does not share code, data, or methodology. A bank that buys an AI scoring product still needs to understand its conceptual soundness, design, development data, and performance, and to monitor outcomes over time.
differentiation
How This Differs From Our Related Pages
This page answers the plain question of what SR 11-7 is and where it stands today. Our page on model risk management from SR 11-7 to SR 26-2 goes deeper on the transition, our page on AI model risk management for banks defines the discipline from a program-building angle, our page on why bank AI models fail model risk review covers examiner findings, and our page on validating an AI model risk consulting vendor covers buying decisions. Use this page when the question is what the term means and whether it covers a particular AI system.
engagement
How an Engagement Works
We start with a scoping call about which models your bank runs, which of them use machine learning or generative AI, and who owns each one today. We then agree a defined scope and deliverables, work alongside your model risk, compliance, and technology leaders, and hand over artifacts you own. We do not replace your independent validation function, give legal advice, or tell you how a regulator will read your program.
tiers
What You Get at Each Tier
1. Enterprise / regulated organizations
A model risk approach for AI: an inventory template that captures AI-specific fields, a classification of each AI system against the SR 26-2 scope language, validation criteria for in-scope models, and a documented control approach for generative and agentic systems that fall outside the formal scope.
2. Fractional CTO / AI governance lead
Ongoing ownership of the AI model inventory, the scope classification, and reporting to your model risk committee while an internal owner is hired or developed.
3. Specialized advisory
A focused session or second opinion on whether a specific AI system is in scope, how a vendor's model documentation maps to the guidance, or how a validation plan reads against it.
rate card
How We Scope and Price This Work
Every engagement is scoped and priced after a short discovery call.
| Track | Typical engagement model |
|---|---|
| Enterprise / regulated (banks, broker-dealers, payment processors) | Fixed-scope project or retainer |
| Fractional CTO / AI governance lead | Part-time, ongoing (monthly) |
| Specialized advisory (vendor evaluation, second opinion) | Per-session |
| Small business | Referred to Kriv AI's partner network |
get a quote
How to Get a Real Quote
Price depends on how many AI systems you run, how many are in scope under the guidance, and how mature your validation and inventory practices are. Book a discovery call and we will scope it honestly.
Sources
Cited sources
Related resources
Continue exploring
Straight answers
Frequently asked questions about What Is SR 11-7 and How Does It Apply to AI Models?
What is SR 11-7?
SR 11-7 is the Federal Reserve's supervisory letter titled Guidance on Model Risk Management, issued April 4, 2011. It was superseded and replaced by SR 26-2 on April 17, 2026.
Is SR 11-7 still in effect?
No. The Federal Reserve's SR 26-2 letter states that the revised guidance supersedes and replaces SR 11-7. Policies and contracts that still cite SR 11-7 should be updated to reference SR 26-2.
Does SR 26-2 apply to AI models?
It applies to traditional statistical and quantitative models and non-generative, non-agentic AI models. It states that generative AI and agentic AI are not within its scope, while expecting a bank's own risk management and governance practices to guide controls for them.
Which banks is SR 26-2 aimed at?
It is expected to be most relevant to banking organizations with over $30 billion in total assets. It may also be relevant to smaller banks with significant exposure to model risk.
Is SR 26-2 legally enforceable?
The guidance says it does not set forth enforceable standards or prescriptive requirements, and that non-compliance will not by itself result in supervisory criticism. Supervisory action can still follow violations of law or unsafe or unsound practices from insufficient model risk management. Ask your counsel how that applies to you.
Talk to the team that would do the work
Bring your requirements to a working session with the person who'll actually deliver.
Book a Discovery Call