Interagency revised guidance on model risk management (SR 26-2 / OCC Bulletin 2026-13), replacing SR 11-7
Risk-based expectations for models banks rely on: an inventory, validation scaled to complexity and materiality and generally done before use, and ongoing monitoring. The guidance does not set enforceable standards. A footnote excludes generative and agentic AI models as novel and rapidly evolving; banks are to govern them through broader risk management until the agencies say more.
Scope. Agents moving money at banks currently sit outside this guidance by its own terms. Until the promised request for information produces something, no federal banking guidance specifically governs agentic AI.
Draft mapping. Drafted by the Register's agents from the rule's text and not yet confirmed by a person. It is the Register's reading, not legal advice: whether and how the rule applies to you is a question for counsel.
Controls this rule maps to
Required by the text The rule's text requires a measure that is this control, or plainly includes it. Implied A binding rule whose purpose needs this control, but whose text does not name it. The Register's reading. Recommended A voluntary standard or guidance recommends it; nothing binds you to it. Proposed Appears in a proposed rule or proposed provision that is not yet in force.
| Control | Strength | Where in the rule, and why | Confidence | Missing or failed in |
|---|---|---|---|---|
| Pre-execution validation C-D1 | Recommended | validation of conceptual soundness and outcomes, generally before the model is put into use | medium | 3 cases |
| Degraded-input detection C-I3 | Recommended | ongoing monitoring of model performance and data quality | low | 3 cases |