AI Model Risk Management: What SR 26-2 Covers, What It Leaves Out and How to Govern LLMs and AI Agents
AI model risk management applies a bank's model risk discipline (inventory, validation, monitoring and governance) to AI systems. SR 26-2, issued April 17, 2026, replaces SR 11-7 but leaves generative and agentic AI out of its scope, so banks govern LLMs and agents through their own risk practices, using the same principles.
Key takeaways
- AI model risk management extends inventory, validation, monitoring and governance to AI systems, including language models, retrieval and agents.
- SR 26-2, issued April 17, 2026 by the Federal Reserve, OCC and FDIC, supersedes and replaces SR 11-7 and SR 21-8.
- SR 26-2 states that generative AI and agentic AI models are not within its scope; its principles apply to traditional statistical models and non-generative, non-agentic AI.
- For LLMs and agents, the guidance points banks to their own risk management and governance practices, so most apply the same four disciplines by analogy.
- Validation of generative AI rests on test sets, release gates, monitoring of real outputs and a verifiable record of what the system did.
AI model risk management is the application of a bank's model risk discipline to AI systems: knowing which ones are in use, validating that they are fit for purpose, monitoring them in production and governing every change. The newest US guidance, SR 26-2, sets that discipline for traditional statistical models and non-generative AI, and it states that generative and agentic AI are outside its scope. That does not leave language models and agents ungoverned. It means banks apply the same principles through their own risk management and governance practices.
This guide covers what SR 26-2 covers and leaves out, how to scope an AI system for model risk purposes, what validation looks like for generative AI, how to treat vendor models, and the evidence a model risk team should expect to keep.
What is AI model risk management?
Model risk is the risk of loss or harm from decisions based on a model that is wrong or used wrongly. For AI, that covers a credit model that drifts, a language model that misstates a policy, a retrieval step that pulls the wrong document, or an agent that acts on the wrong record.
AI model risk management answers four questions for every AI system:
- What is it and who owns it? An inventory entry with a business owner, a technical owner and the decisions it supports.
- Does it work for this use? Validation against the intended use, with evidence.
- Is it still working? Monitoring of real outputs, errors and drift after launch.
- Who approved each change? Governance over prompts, data sources, tools and model versions.
What does SR 26-2 cover, and what does it leave out?
On April 17, 2026 the Federal Reserve, the OCC and the FDIC issued the Revised Guidance on Model Risk Management as SR 26-2. The letter states that it supersedes and replaces SR 11-7, the 2011 guidance banks have applied for years, and SR 21-8. The Federal Reserve publishes the letter on its SR 26-2 page.
Three points in the text matter for AI:
- A narrow definition of model. The guidance defines a model as a complex quantitative method, system or approach that applies statistical, economic or financial theories to process input data into quantitative estimates. It excludes simple arithmetic and deterministic, rule-based processes.
- Generative and agentic AI are out of scope. A footnote says these models are novel and rapidly evolving and are not within the scope of the guidance. It adds that a bank's own risk management and governance practices should guide the controls for tools it does not cover, and that the guidance's principles apply to traditional statistical and quantitative models and to non-generative, non-agentic AI.
- Proportionate application. The guidance is expected to be most relevant to banking organizations with more than $30 billion in total assets, and smaller banks typically rely on internal practices suited to their size and risk.
| System | Where it sits under SR 26-2 |
|---|---|
| Traditional statistical and quantitative models, such as credit scoring | In scope |
| Non-generative, non-agentic AI, such as a classic machine-learning classifier | Principles apply |
| Generative AI and large language models | Not in scope; the bank's own governance decides the controls |
| Agentic AI | Not in scope; the bank's own governance decides the controls |
| Spreadsheet arithmetic and deterministic rules | Excluded from the definition of a model |
Why govern LLMs and agents like models anyway?
Because the guidance tells banks to. For tools it does not cover, SR 26-2 points to the bank's risk management and governance practices, and a language model that drafts credit commentary or an agent that touches a customer record carries the same kinds of risk the guidance describes: wrong outputs, drift, unclear ownership and changes nobody approved.
In practice, banks reuse the four disciplines above and scale the rigor to the risk. A staff-facing drafting assistant needs lighter validation than an agent that touches customer accounts. Each AI system still belongs in the inventory, with its components named and an owner who can answer for it.
Which part of an AI system is the model?
An AI system is not one model. A typical assistant or agent has at least five components, and each carries different risk:
| Component | What it does | Model risk question | How to test it |
|---|---|---|---|
| Language model | Interprets requests and generates text | Is it accurate and consistent for this use? | Test set of real questions with expected answers |
| Retrieval | Finds the documents or records the answer relies on | Does it fetch the right, current, permitted sources? | Retrieval precision checks and permission tests |
| Prompts and instructions | Constrain what the model does and how | Do changes alter behavior unexpectedly? | Re-run the test set on every prompt change |
| Tools and actions | Let an agent query systems or take actions | Can it act on the wrong record or beyond its authority? | Action-tier tests and approval checks |
| Rules and calculations | Compute figures and apply fixed policy | Are figures correct and reproducible? | Unit tests against systems of record |
Scoping this way has a practical benefit: if rules and calculations make the decision and the language model only interprets and explains, the language model's validation can focus on comprehension and explanation quality. The narrower the role of the language model, the narrower and more testable its validation.
How do you validate a large language model?
Validating generative AI rests less on statistical model diagnostics and more on structured testing of outputs in context:
- Build a test set from real use. Questions and tasks drawn from the people who will use the system, including edge cases and questions the system should refuse. Our guide on how to score a RAG answer covers grading.
- Define pass criteria before testing. Accuracy, citation correctness, refusal behavior and consistency, with thresholds agreed with the business owner.
- Gate every release. The system must pass the test set before launch and after every change to the prompt, retrieval sources, tools or model version.
- Monitor real outputs. Sample production outputs, track escalations and user corrections, and watch for drift when the vendor updates the model.
- Keep the evidence. Test results, approvals and production records should be exportable for internal audit and examiners.
A validator cannot inspect a vendor's training data. They can inspect what the system did on your test set, what it did in production, and who approved each change. Design for that evidence from day one.
How should banks handle vendor and third-party AI models?
Vendor models are the norm. SR 26-2 includes a section on vendor and other third-party products for the models it covers, and the expectations for AI vendors also overlap with third-party risk management. The OCC, the Federal Reserve and the FDIC describe how banks should manage vendor relationships across their life cycle in the 2023 interagency guidance on third-party risk management. For AI vendors, the questions that matter most are:
- Which models run, and where? Model versions, hosting location and whether customer data leaves your environment. Our guide to self-hosted enterprise AI in a VPC covers the deployment options.
- How are model updates controlled? Whether the bank is notified of, and can test, a new model version before it reaches users.
- What evidence does the vendor provide? Architecture, data flow, testing, security controls and change records.
- Can the bank verify the record itself? An AI audit trail that the bank can verify independently is stronger evidence than a vendor's log.
What about AI agents?
Agents raise the stakes because they act. Since SR 26-2 leaves agentic AI to the bank's own governance, the controls have to be designed rather than inherited. Treat each agent's actions as part of its intended use: classify every action as automatic, approval-required or forbidden, test the boundaries, and record every action with its approver. We cover the operating side in AI agent governance, and the EU dimension in our EU AI Act compliance checklist.
A checklist for your next AI model review
- The AI system is in the inventory with named business, technical and compliance owners.
- Each component (model, retrieval, prompts, tools, rules) is listed with its role.
- The decisions the language model makes are written down, and kept as narrow as possible.
- A test set and pass criteria exist and were agreed before testing.
- Every release, including vendor model updates, passes the test set.
- Production outputs are sampled and reviewed on a defined schedule.
- Vendor documentation covers architecture, data flow, testing and change control.
- Every output and action can be traced to its inputs, sources and approver.
What a governed platform adds
Most of this evidence is a by-product of how the platform runs. In SphereIQ, every retrieval, model call, approval and action lands on an Ed25519-signed audit ledger; access scopes inherit source-system permissions; evaluation sets gate releases; and actions that touch money or customers wait for a person. SphereIQ is SOC 2 Type II certified, and SphereIQ Private runs in your own cloud. See how this applies to banks on the financial services solution page.
Frequently asked questions
What is AI model risk management?
What is SR 26-2?
Does SR 26-2 apply to LLMs and AI agents?
Does SR 11-7 still apply to AI?
How should banks manage risk from vendor AI models?
Show your model risk team the evidence trail.
Bring one AI use case. We show the inventory entry, the evaluation gate, the approvals and the signed audit record it produces.