Model Risk Management for AI: What SR 11-7 Expects and What Changes

Federal Reserve, OCC, and FDIC guidance issued in April 2026 replaced SR 11-7 with SR 26-2, retaining the core model risk management pillars of development, independent validation, and governance while introducing a more explicit risk-based approach that scales oversight according to a model’s inherent risk, exposure, purpose, and use. The guidance applies most directly to banking organizations with more than $30 billion in assets, continues to require oversight of third-party models, and rescinds separate BSA/AML model guidance in favor of the broader framework. Generative and agentic AI are currently excluded from SR 26-2’s formal scope, leaving institutions responsible for creating their own governance while regulators consider future AI-specific guidance. The discussion highlights challenges posed by machine learning models that drift, retrain, or operate as vendor-controlled black boxes, as well as concentration risks from reliance on a small number of foundation-model providers. It argues that banks should expand model inventories to identify embedded or shadow AI, document materiality decisions, monitor adaptive models more continuously, assign ownership for AI outside formal regulatory scope, and use privacy-preserving technologies such as federated learning, secure multiparty computation, homomorphic encryption, differential privacy, and confidential computing to validate models without centralizing sensitive data.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.