What does SR 26-2 say about AI in banking?

What are the key points of SR 26-2?

• Supersedes SR 11-7 (April 4, 2011) and SR 21-8 (April 9, 2021); the OCC also rescinded Bulletins 2011-12, 2021-19, and 1997-24 and its Model Risk Management handbook booklet
• Defines a model as a complex quantitative method that applies statistical, economic, or financial theories to process input data into quantitative estimates; simple arithmetic and deterministic rule-based processes are excluded
• Explicitly excludes generative AI and agentic AI models from scope as 'novel and rapidly evolving', while telling banks to apply broader risk-management and governance practices to tools not covered
• Adopts a risk-based approach tailored to a bank's model risk profile, size, and complexity, with materiality driving the intensity of validation and monitoring
• Retains the core disciplines of SR 11-7: sound development and testing, independent validation including outcomes analysis, effective challenge, and board/senior-management governance
• Covers vendor and third-party models, expecting banks to understand and validate purchased models consistent with third-party risk management (SR 23-4)
• Most relevant to banking organizations over $30 billion in assets, but smaller banks with prevalent or complex models are expected to apply it proportionately

What did SR 26-2 change for banks?

For traditional and machine-learning models, banks get relief from one-size-fits-all validation: materiality now governs how much rigor a model needs, and low-risk deterministic tools drop out of the model inventory. For generative and agentic AI the guidance creates a deliberate gap — no model-validation mandate, but an expectation that enterprise risk, vendor risk, data governance, and board oversight cover these systems until the promised interagency RFI and any follow-on guidance arrive.