What does SR 11-7 say about AI in banking?

What are the key points of SR 11-7?

• Defines a 'model' as a quantitative method, system, or approach that applies statistical, economic, financial, or mathematical theories, techniques, and assumptions to process input data into quantitative estimates — a definition banks applied to ML and AI models
• Defines model risk as the potential for adverse consequences from decisions based on incorrect or misused model outputs, arising from fundamental errors or from misuse
• Requires sound model development, implementation, and use, with documentation sufficient for independent review
• Requires validation comprising conceptual soundness review, ongoing monitoring (including benchmarking), and outcomes analysis (including back-testing)
• Introduced 'effective challenge' — critical analysis by objective, informed parties with the incentives, competence, and influence to force changes
• Requires a governance framework: board and senior management oversight, policies and procedures, a model inventory, and internal audit assessment
• Extends expectations to vendor and third-party models, requiring banks to validate and understand models they did not build

What did SR 11-7 change for banks?

SR 11-7 turned model governance into an examinable discipline with formal roles (developers, validators, internal audit) and a comprehensive model inventory. Because its model definition was technology-neutral, banks used it for machine-learning credit, fraud, and AML models throughout the 2010s and early 2020s, and its validation language was borrowed by regulators worldwide. Its 2026 replacement keeps the same architecture but narrows scope, adds materiality-based tailoring, and explicitly carves out generative and agentic AI.