According to a law-firm analysis by Orrick, the OCC, the Federal Reserve and the FDIC jointly issued revised model risk management guidance on 17 April 2026. It replaces the 2011 guidance known as SR 11-7 and several related documents. We are reading the guidance through that secondary analysis; confirm the details against the agencies' text.
What changed
- It is described as most relevant to banks with more than $30 billion in assets; the previous reference point was $1 billion.
- The definition of a model is narrowed to a complex quantitative method, with spreadsheets, simple arithmetic and deterministic rule-based processes carved out.
- Generative and agentic AI are excluded from scope, described as novel and rapidly evolving, and the agencies plan to seek input on banks' AI use.
- The guidance states that it sets out no enforceable standards.
- A new section addresses vendor models that a bank cannot fully validate.
What it means in practice
A bank can no longer assume that its model risk framework covers its AI assistants and agents. Those systems still need governance, testing, logging and accountability; they just need it from somewhere else. For banks in Europe, other rules apply, but the practical point is the same: do not wait for a regulator to define the control framework for AI agents.
If your AI governance lives only inside model risk management, check whether generative and agentic systems are actually covered by it.