These guides explain, one rule at a time, the frameworks that supervisors use when they examine a bank's AI and model programmes: what the text actually says (with principle and article numbers), who it applies to and since when, what supervisors have found, and where AI, machine-learning and LLM systems fall inside it. Each guide has a principles or obligations table, hand-drawn diagrams, an FAQ and a dated source list, and links to the tracked document pages that carry the official text and every update. The document pages stay the place for status, deadlines and what changed; the guides are the place to understand the rule.
| Guide | What it covers | Updated |
|---|---|---|
| BCBS 239 explained: the 14 principles and what they mean for AI Basel Committee · Principles, January 2013 | The 14 principles in four groups, what compliance looks like, the 2013–2026 timeline of progress reports, who enforces it and how AI data pipelines are examined under it. | Oct 15, 2026 |
| SR 11-7 and OCC 2011-12 explained: model risk management for AI models Federal Reserve · OCC · Guidance, April 2011 (superseded April 2026) | The 2011 US model risk guidance explained: model and model-risk definitions, the three pillars as a lifecycle, the three validation elements, what the inventory and validation report hold, and where ML and generative AI stand after SR 26-2. | Oct 15, 2026 |
| DORA explained: the five pillars and what they require for AI and ICT third parties European Union · Regulation (EU) 2022/2554, applies since 17 January 2025 | The five pillars with article ranges, the dates from adoption to critical-provider oversight, obligations by article, how AI and LLM vendors fall under the ICT third-party rules, and the RTS/ITS that complete the Regulation. | Oct 15, 2026 |
| NIST AI RMF explained: Govern, Map, Measure, Manage for banks NIST · Framework, January 2023 · profiles 2024–2026 | The four functions, 19 categories and 72 subcategories of AI RMF 1.0, the seven trustworthiness characteristics with bank examples, the twelve generative-AI risks of AI 600-1, where AI 100-2 and IR 8596 fit, and which US regulators and state laws cite the framework. | Oct 15, 2026 |
| PRA SS1/23 explained: the five model risk principles and how they cover AI Bank of England PRA · Supervisory Statement, May 2023 · in force May 2024 | The five principles and 23 sub-principles of PRA SS1/23, model tiering, the exact paragraphs that reach AI and machine learning, the CP6/22-to-2026 timeline, the SR 11-7 mapping and which UK banks say their AI governance is built on it. | Oct 15, 2026 |
Which guide do I need?
Data behind a model: BCBS 239 is the standard supervisors apply to the lineage, completeness and timeliness of risk data, including the data that trains and feeds AI models. The model itself: in the United States that was SR 11-7 / OCC 2011-12 until April 17, 2026 and is now SR 26-2; in the United Kingdom it is PRA SS1/23; the NIST AI RMF is the voluntary vocabulary US banks use for AI-specific risks the model-risk guidance leaves out. The systems and vendors the model runs on: in the EU that is DORA, which treats every AI vendor and cloud dependency as an ICT third-party arrangement.
When one of these rules moves, the next morning's brief says so
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am ET · free
plus every tracker, bank and agent page update, the morning after · leave any morning