Why Can't Compliance Keep Up With AI Adoption in Financial Services?

In April 2026 the OCC, Federal Reserve, and FDIC issued SR 26-2, a revised interagency model risk management guidance that replaced the 2011-era SR 11-7. According to a Sullivan & Cromwell client memo analyzing the guidance, the agencies explicitly excluded generative and agentic AI models from its scope, describing them as 'novel and rapidly evolving.' Banks are told to apply their 'broader risk management and governance practices' to these systems instead of a specific framework, and the agencies have said they plan to issue a request for information on AI model risk in the near future. That leaves compliance teams building governance for the fastest-growing category of models without a finished rulebook to build against.

This is not a hypothetical gap. It means the single most-cited compliance reference document in U.S. banking, model risk guidance, does not yet formally cover the AI systems banks are deploying fastest. Compliance officers are left applying general enterprise risk principles by analogy, which is slower and more contested internally than working from a specific supervisory standard.

Even where federal guidance exists, it is split across agencies with no unified standard. A Goodwin Procter legal alert on the evolving AI regulatory landscape in financial services notes that the Federal Housing Finance Agency and Consumer Financial Protection Bureau began issuing AI compliance directives as early as September 2022, and that the Federal Trade Commission, Department of Justice, OCC, Federal Reserve, and Equal Employment Opportunity Commission have each issued their own separate AI oversight statements, with neither a consensus nor a binding law on AI regulation at the federal level forming. States have filled the vacuum with their own rules: Goodwin cites California consumer protection advisories applied to AI, a Colorado law requiring disclosure of AI-driven lending decisions effective February 2026, an Illinois law expanding oversight of AI used in creditworthiness determinations effective January 2026, and New York City's independent audit mandate for automated employment decision tools.

For a bank operating in multiple states, this means the compliance function has to track and reconcile a different, moving set of AI-specific obligations in every jurisdiction it serves, on top of federal guidance that is itself unsettled. Fragmented internal data compounds the problem: an AscentAI 2026 RegTech Benchmark Survey, reported by fintech.global, found that 39% of respondents cited fragmented compliance data and the absence of a single source of truth as a major challenge, rising to 67% among Tier 1 banks specifically.

Adoption inside banks has simply outpaced the internal machinery meant to govern it. Deloitte's banking-sector AI governance research found that 63% of bank employees now use AI on a weekly basis, yet only 13% of banks have reached a leading maturity stage for AI governance, and 87% of banks could significantly improve their governance frameworks. On training specifically, Deloitte found only 15% of banks provide regularly refreshed AI governance training to all staff, while a third of global banks rely on ad hoc training or provide none at all.

A separate ACA Group survey of over 200 U.S. financial firms, conducted around the GAIM Ops conference in April 2026, quantifies the same gap from the usage side: 84% of firms report using AI somewhere in the organization, but active AI use inside the compliance function itself is under 20%, and inside operations it is around 5%. ACA's Jody Kochansky, Head of Product and Engineering, summarized it this way: 'Most firms are still in the experimentation phase, relying on desktop tools that sit outside of their core workflows. The real opportunity, and the real challenge, is moving from informal use to embedded, governed, auditable deployment.'