AI model governance is the application of model risk management discipline to artificial-intelligence systems that inform or produce compliance decisions. In U.S. banking supervision the current framework is the interagency Revised Guidance on Model Risk Management of April 17, 2026 (Federal Reserve SR 26-2, OCC Bulletin 2026-13, FDIC FIL-15-2026), which superseded SR 11-7. It supplies the principles: sound development and use, validation with effective challenge, ongoing monitoring, and documented governance. An AI compliance tool is defensible when the institution can explain how the model works, show that it was validated, and identify the qualified person who reviewed and attested to the output. Accountability rests with that named person rather than with the model.
AI model governance is the application of model risk management discipline (sound development, validation, and documented oversight) to artificial-intelligence systems that inform or produce compliance decisions. In U.S. banking supervision the controlling framework, as of September 2026, is the Revised Guidance on Model Risk Management issued jointly on April 17, 2026 by the Board of Governors of the Federal Reserve System (SR 26-2), the Office of the Comptroller of the Currency (OCC Bulletin 2026-13), and the Federal Deposit Insurance Corporation (FIL-15-2026). It superseded SR 11-7, the 2011 guidance that governed model risk for fifteen years, together with the 2021 interagency statement on model risk for bank systems supporting BSA/AML compliance (SR 26-2).
This guide covers what the current guidance requires, how it replaced SR 11-7, which AI compliance tools it reaches and which it leaves to the institution's own governance, what validation and effective challenge look like in practice, the function of explainability and the audit trail, and the questions an institution puts to a vendor selling an AI compliance tool.
Supervisory posture toward AI in compliance
Compliance teams have adopted AI to score risk, draft SAR narratives, tune monitoring, and read regulatory change, and supervisory attention has followed. The examination question concerns how an institution controls the model it uses rather than whether it uses one. Documented control over the model is the condition on which supervisory acceptance turns; an AI treated as an unexamined vendor black box does not satisfy it. In issuing the 2026 guidance, the agencies stated that they plan to issue a request for information on model risk management that considers, in particular, banks' use of AI, including generative AI, agentic AI, and AI-based models (OCC Bulletin 2026-13).
History: SR 11-7, 2011 to 2026
SR 11-7, the Supervisory Guidance on Model Risk Management, was issued by the Federal Reserve on April 4, 2011 and adopted by the OCC as Bulletin 2011-12; the FDIC adopted it in 2017 (FIL-22-2017). For fifteen years it was the reference standard for how a regulated institution manages the risk of relying on a model, organized around sound development, implementation, and use; effective and independent validation; and governance, policies, and controls. In April 2021 the agencies added an interagency statement applying model risk management to bank systems supporting BSA/AML compliance (SR 21-8, OCC Bulletin 2021-19, FDIC FIL-27-2021).
On April 17, 2026, SR 26-2 superseded both SR 11-7 and SR 21-8. The OCC rescinded Bulletin 2011-12, Bulletin 2021-19, Bulletin 1997-24 on credit scoring models, and the Model Risk Management booklet of the Comptroller's Handbook (OCC Bulletin 2026-13), and the FDIC rescinded FIL-22-2017 and FIL-27-2021 (FIL-15-2026). SR 26-2 describes the revision as reflecting supervisory experience and industry feedback, as well as technological advancements in modeling. Much of the SR 11-7 vocabulary (conceptual soundness, outcomes analysis, ongoing monitoring, effective challenge, model inventory) carries forward into the new text.
What the current guidance is
The 2026 guidance states that it highlights sound principles for effective model risk management and that practices vary from one banking organization to another, with each organization responsible for adopting practices appropriate to the risks it faces (SR 26-2, Attachment, Part I). It sets out a risk-based approach tailored to a banking organization's model risk profile and the size and complexity of its operations (Part II). It also states that it does not set forth enforceable standards or prescriptive requirements and that non-compliance with it will not result in supervisory criticism, while noting that supervisory action may still result from violations of law or unsafe or unsound practices stemming from insufficient management of model risk (Part I, note 1).
Applicability and the $30 billion statement
SR 26-2 states that the guidance "is expected to be most relevant to banking organizations with over $30 billion in total assets." The attachment explains that models at organizations of $30 billion or less typically are subject to internal risk management and governance appropriate to their size and risk profile, and that the guidance may still be relevant to a smaller organization with significant exposure to model risk because of the prevalence and complexity of its models or activities outside traditional community banking (Part II). The OCC bulletin is addressed to all national banks, federal savings associations, and federal branches and agencies, and the FDIC letter applies to all FDIC-supervised financial institutions. For institutions below the threshold, the principles remain the reference point an examiner or independent tester is likely to use when an AI tool drives a compliance decision, even where the guidance itself is not directed at them.
The definition of a model
The guidance defines a model as "a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates." It excludes "simple arithmetic calculations, such as those found within spreadsheets, as well as deterministic rule-based processes and software where there are no statistical, economic, or financial theories underpinning their design or use" (Part II). The exclusion matters in compliance: a deterministic threshold scenario in a transaction monitoring system can fall outside it, while a statistically derived risk score or a machine-learning alert classifier falls within it.
Generative and agentic AI
The guidance states that "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance." It adds that an institution's risk management and governance practices should guide the controls for any tools, processes, or systems not covered, and that its principles apply to traditional statistical and quantitative models and to non-generative, non-agentic AI models (Part II, note 3). A large language model that drafts a SAR narrative or summarizes regulatory change is therefore governed under the institution's own framework rather than under SR 26-2 directly. The NIST AI Risk Management Framework (AI RMF 1.0, 2023) and its Generative AI Profile (NIST-AI-600-1, July 2024) supply a common vocabulary for generative risks such as confabulation and information integrity; they are voluntary, and they are the reference a model-risk team commonly maps to when the tool is generative.
The elements of the guidance
| Element | What the guidance describes |
|---|---|
| Model development and use | A clear statement of purpose, input from model users, and testing commensurate with complexity and materiality; use grounded in a clear understanding of the model's limitations, with additional analysis when a model is extended beyond its original application (Part IV). |
| Validation and monitoring | Conceptual soundness, outcomes analysis, and ongoing monitoring, with nature and rigor aligned to the model's approach, use, and materiality (Part V). |
| Governance and controls | Policies and procedures, clear roles and responsibilities including conflicts of interest between development and validation, a model inventory, and documentation; internal audit evaluates whether model risk management is rigorous and effective (Part VI). |
| Vendor and other third-party products | The principles remain applicable when code, data, or methodology are proprietary; the institution develops an understanding of the vendor model and validates and monitors it (Part VII). |
Where the emphasis changed
- Materiality and tailoring. Model risk is assessed through inherent risk, exposure, purpose, and use, with model purpose and exposure together determining materiality; immaterial models may warrant only identification and performance monitoring (Part III).
- Narrower scope. Deterministic rule-based processes and generative and agentic AI are outside the guidance (Part II and note 3).
- Rigor over structure. The quality of validation "depends on the rigor and effectiveness of the review rather than on organizational structure" (Part V).
- Non-enforceable principles. The guidance disclaims enforceable standards and supervisory criticism for non-compliance, while leaving unsafe or unsound practices actionable (Part I, note 1).
- BSA/AML folded in. The separate 2021 BSA/AML statement is superseded, so BSA/AML systems are assessed under the same general definition and principles as every other model.
What validating an AI compliance model means
SR 26-2 describes validation as an evaluation of whether models perform as expected, including an assessment of reliability and limitations, and it names three components, each of which maps onto an AI system (Part V):
- Conceptual soundness. Assessing and documenting model design, including key modeling choices, assumptions, qualitative judgments, and data selection, together with construction and developmental testing. For an AI model this reaches the data it learned from and the assumptions built into it.
- Outcomes analysis. Comparing model outputs to corresponding real-world outcomes, through developmental testing, ongoing reports, or standalone back-testing and outlier analysis. Outcomes analysis converts an asserted accuracy rate into documented evidence of accuracy.
- Ongoing monitoring. Evaluating whether the model still performs as expected given changes in products, exposures, activities, clients, data relevance, or market conditions. Models drift as customer behavior, products, and typologies move, and monitoring is the control that detects the drift.
Effective challenge is the operative condition. The guidance defines it as "the critical analysis conducted by objective experts who evaluate model risk and effect appropriate changes throughout the model lifecycle," performed by individuals with the expertise to conduct it, sufficient independence to maintain objectivity, and the organizational standing and influence to effect change (Part III). Validation performed by the same people who built the model, without that separation, carries limited weight in examination.
Explainability and the audit trail
A model that produces a score or a narrative with no traceable reasoning gives a reviewer nothing to inspect, and an attribution of the outcome to the model itself does not identify a decision-maker. The 2026 guidance recognizes interpretability measures and benchmarking to other models as practical ways to assess conceptual soundness where evaluating theoretical construction is not (Part V). Two elements address the condition in practice. Explainability means the institution can describe, in terms a reviewer follows, how the model reached its result. The audit trail means every step is logged, so the path from input to output can be reconstructed long after the fact; the guidance ties documentation to continuity of operations and to tracking recommendations, responses, and exceptions (Part VI). Together they make an otherwise opaque output inspectable.
The human in the loop
Under this control a qualified person reviews the AI's work and attests to it before that work is used: the model produces a draft and the reviewer decides whether to adopt it. The guidance does not use the term, but it observes that material model risk can remain even after rigorous validation and that users of model output benefit from understanding limitations, monitoring performance, and supplementing model output with complementary analysis and information (Part V). The control matters because accountability cannot sit with a model. It sits with a named person who can be asked to explain a filing or a decision. For generative tools outside the scope of SR 26-2, the human attestation is often the principal control the institution's own governance relies on.
Questions to ask an AI compliance vendor
SR 26-2 states that an important element of model risk management is the validation of vendor products, and that sound practice includes understanding the vendor model's conceptual soundness, design, development data, and performance, and conducting ongoing monitoring and outcomes analysis on it (Part VII). An institution evaluating a tool that places AI near a compliance decision puts the following questions to the vendor and weighs the answers:
- Is the tool a model under the 2026 definition, a deterministic rule-based process, or a generative or agentic system outside the guidance, and which governance applies to each component?
- How does the AI reach a result, and is that reasoning auditable?
- How was the model validated, and by someone with the expertise and independence that effective challenge requires?
- What ongoing monitoring detects drift as conditions change?
- How is bias tested, and how often?
- Where in the workflow does a human review and attest before output is used?
- What audit trail could an examiner inspect, and how far back does it reach?
- Can the vendor produce documentation mapped to the elements of the 2026 guidance (development and use, validation and monitoring, governance and controls)?
A vendor that cannot explain how its AI reaches a result leaves the institution without the documentation an examination requires. Governing an AI system on the same terms as any other model, or under the institution's own framework where the guidance does not reach it, preserves the institution's ability to support the result.