What is model risk management?
Model risk management (MRM) is how a bank controls the risk that a model is wrong or misused: disciplined model development and use, independent validation and ongoing monitoring, and governance through policies, a model inventory, defined roles and internal audit. The US framework was SR 11-7 and OCC Bulletin 2011-12 until April 17, 2026; it is now SR 26-2, OCC Bulletin 2026-13 and FDIC FIL-15-2026, which keep machine-learning models in scope and leave generative and agentic AI outside.
This page maps each part of the framework to the document that sets it out: SR 11-7 and OCC Bulletin 2011-12 for the 2011 text, SR 26-2 and OCC Bulletin 2026-13 for the guidance now in force, and the UK, euro-area and Basel documents that sit beside them. For the wider governance picture see AI governance in banking.
The framework
What is the model risk management framework for US banks?
Since April 17, 2026 it is one interagency text issued under three numbers: the Federal Reserve's SR 26-2, OCC Bulletin 2026-13 and FDIC FIL-15-2026. It replaced the 2011 guidance (SR 11-7 / OCC Bulletin 2011-12) and keeps its architecture: sound model development and use, independent validation and ongoing monitoring, and governance and controls, with a separate section on vendor and other third-party products. What changed is the footing. The guidance is risk-based and scaled to model materiality, is expected to be most relevant above $30 billion in total assets, defines a model as a 'complex' quantitative method, and says non-compliance will not by itself draw supervisory criticism.
| Rule | Authority | What it requires | Applies |
|---|---|---|---|
| SR 26-2 (Federal Reserve) | Federal Reserve | Revised Guidance on Model Risk Management for Fed-supervised organisations; supersedes SR 11-7 and SR 21-8. | In force from Apr 17, 2026 |
| OCC Bulletin 2026-13 | OCC | The same guidance for national banks and federal savings associations; rescinds Bulletins 2011-12, 1997-24 and 2021-19 and the Comptroller's Handbook 'Model Risk Management' booklet. | In force from Apr 17, 2026 |
| FDIC FIL-15-2026 | FDIC | The same guidance for FDIC-supervised institutions; rescinds FIL-22-2017 and FIL-27-2021. | In force from Apr 17, 2026 |
| SR 11-7 (2011 guidance) | Federal Reserve | The original three elements: development, implementation and use; validation; governance, policies and controls. Introduced 'effective challenge' and the firm-wide model inventory. | Superseded Apr 17, 2026 |
| OCC Bulletin 2011-12 | OCC | The OCC's issuance of the same 2011 guidance, 'Sound Practices for Model Risk Management'. | Rescinded Apr 17, 2026 |
| OCC Bulletin 1997-24 (credit scoring models) | OCC | The OCC's first examination guidance on models: validation, monitoring and fair-lending risk in credit scoring. | Rescinded Apr 17, 2026 |
| 2021 BSA/AML model risk statement (SR 21-8 / OCC 2021-19 / FIL-27-2021) | Federal Reserve | How model risk principles apply to transaction monitoring, sanctions screening and customer risk rating, including machine-learning systems. | Superseded Apr 17, 2026 |
| SR 23-4 / OCC 2023-17 / FIL-29-2023 (third-party risk) | Federal Reserve | The lifecycle guidance for the vendor relationship behind a bought model: due diligence, contracting, ongoing monitoring, termination. | In force from Jun 7, 2023 |
Model inventory and tiering
What goes in a model inventory, and how are models tiered?
A model inventory is the firm-wide record of every model in use or under development, with enough information to understand each model's risk and the bank's model risk in aggregate. The 2011 guidance listed what it should hold: purpose and products, actual and expected use, restrictions, inputs and outputs, responsible individuals, and the dates of completed and planned validation. Tiering decides how much scrutiny each entry gets. SR 26-2 builds it on materiality, which it defines as model exposure together with model purpose: models a bank deems immaterial may only need identifying and monitoring, while higher-materiality models 'warrant more comprehensive and rigorous oversight'. The UK's SS1/23 makes model identification and risk classification its first principle.
| Rule | Authority | What it requires | Applies |
|---|---|---|---|
| SR 26-2: materiality and the inventory | Federal Reserve | Materiality is model exposure plus purpose; risk is assessed per model and in aggregate; the inventory holds sufficient information to understand model risks at both levels. | In force from Apr 17, 2026 |
| SR 11-7: what an inventory records | Federal Reserve | Models in use, under development or recently retired: purpose, products, usage and restrictions, inputs and outputs, whether the model is functioning properly, owners and validators, validation dates. | Superseded Apr 17, 2026 |
| PRA SS1/23, Principle 1 | UK (BoE / PRA / FCA) | The first of the five principles is 'Model identification and model risk classification': identify what counts as a model, then classify each by risk. | In force from May 17, 2024 |
| PRA AI/ML model-risk roundtable | UK (BoE / PRA / FCA) | The PRA's thinking on risk appetite and model tiering for AI and machine-learning models under SS1/23. | Published Nov 24, 2025 |
Validation and monitoring
What does model validation involve?
Validation is the set of activities that verify a model performs as expected for its design objectives and business use. Under both the 2011 and 2026 US guidance it has three components: conceptual soundness (design, assumptions, data and developmental testing), outcomes analysis (comparing outputs with real-world outcomes, including back-testing) and ongoing monitoring (whether the model still performs as products, data and markets change). SR 26-2 says validation generally occurs before first use, that its timing and depth vary with purpose, methodology and materiality, and that its quality 'depends on the rigor and effectiveness of the review rather than on organizational structure'. Effective challenge needs expertise, independence and the standing to effect change.
| Rule | Authority | What it requires | Applies |
|---|---|---|---|
| SR 26-2: validation and monitoring | Federal Reserve | Conceptual soundness, outcomes analysis and ongoing monitoring, scaled to materiality; interpretability measures or benchmarking may substitute for theoretical review where more practical. | In force from Apr 17, 2026 |
| SR 11-7: the three core elements | Federal Reserve | Evaluation of conceptual soundness, ongoing monitoring with process verification and benchmarking, outcomes analysis with back-testing; periodic review of each model at least annually. | Superseded Apr 17, 2026 |
| PRA SS1/23, Principle 4 | UK (BoE / PRA / FCA) | The fourth of the five principles is 'Independent model validation'; it sits alongside governance, development and use, and model risk mitigants. | In force from May 17, 2024 |
| ECB Guide to internal models, ML section | ECB | Machine-learning capital models must be adequately explainable and their complexity justified by performance. | In force from Jul 28, 2025 |
| EBA follow-up report on ML for IRB models | EBA | Principle-based recommendations on understanding, documenting, validating and monitoring machine-learning capital models. | Published Aug 4, 2023 |
Three lines of defense
What are the three lines of defense in model risk management?
The three lines of defense assign model risk to three groups: the business units that own, develop and use models (first line), an independent model risk management and validation function that controls that risk and provides effective challenge (second line), and internal audit, which tests whether the whole framework works (third line). US model risk guidance does not use the phrase. SR 11-7 divides the roles among 'ownership, controls, and compliance' and gives internal audit its own section; the OCC's heightened standards for large banks name front line units, independent risk management and internal audit; and the Basel Committee's corporate governance principles describe business units, risk management and internal audit as 'the three lines of defence'.
| Line | Who | Role in model risk management | Where it comes from |
|---|---|---|---|
| First line | Business units, model owners, developers and users | Accountable for model use and performance; ensure models are properly developed, implemented and used, have been validated and approved, and that new or changed models are identified. | SR 11-7, Section VI: 'Business units are generally responsible for the model risk associated with their business strategies.' |
| Second line | Independent model risk management and validation (risk-control staff) | Manages independent validation and review so that effective challenge takes place; sets limits and monitors them; can restrict the use of a model; reports issues to senior management with a corrective-action plan. | SR 11-7, Section VI: 'Control staff should have the authority to restrict the use of models.' OCC heightened standards: independent risk management. |
| Third line | Internal audit | Assesses the overall effectiveness of the framework; verifies policies are followed and the inventory is accurate and complete; does not duplicate validation. | SR 11-7, Section VI ('Internal Audit'); SR 26-2, 'Roles and Responsibilities'; OCC heightened standards: internal audit. |
| Above the lines | Board of directors and senior management | Set the framework, approve model risk policies and review them annually, and receive reporting on aggregate model risk and on validation and audit findings. | SR 11-7, Section VI ('Board of Directors and Senior Management'). |
SOURCES: SR 11-7 attachment: Supervisory Guidance on Model Risk Management (PDF) ↗ · SR 26-2 attachment: revised guidance (PDF) ↗ · OCC heightened standards, 12 CFR Part 30, Appendix D ↗ · BCBS, Corporate governance principles for banks (2015) ↗
AI, machine learning and generative AI
How does model risk management apply to AI, machine learning and generative AI?
In the US the line runs between predictive and generative systems. SR 26-2 states that its principles apply to 'traditional statistical and quantitative models and non-generative, non-agentic AI models', so a machine-learning credit, fraud or AML model is validated like any other model, in proportion to its materiality. Generative AI and agentic AI models are 'novel and rapidly evolving' and 'not within the scope of this guidance'; a bank's broader risk management and governance practices decide their controls, and the agencies plan a request for information on model risk management and banks' use of AI. The UK runs the other way: the PRA's SS1/23 keeps AI and machine learning inside model risk management.
| Rule | Authority | What it requires | Applies |
|---|---|---|---|
| SR 26-2, footnote 3 | Federal Reserve | Non-generative, non-agentic AI models are in scope; generative and agentic AI are outside it and governed through the bank's broader risk management and governance practices. | In force from Apr 17, 2026 |
| PRA SS1/23 | UK (BoE / PRA / FCA) | Covers all models regardless of technology; tiering weighs unstructured data, interpretability, explainability and bias for newly advanced approaches, and dynamic models that change autonomously need change testing. | In force from May 17, 2024 |
| PRA AI/ML model-risk roundtable | UK (BoE / PRA / FCA) | Explainability and interpretability, data and overfitting, independent validation and ongoing monitoring of AI models. | Published Nov 24, 2025 |
| BCBS AI/ML newsletter | Basel Committee | Model complexity and interpretability, data quality and bias, and governance and accountability named as the supervisory concerns with AI/ML models. | Published Mar 16, 2022 |
| 2021 Interagency AI RFI | Federal Reserve | The agencies' questions on explainability, overfitting, dynamic updating and third-party AI under existing model risk guidance. | Comments closed Jul 1, 2021 |
| NIST AI RMF 1.0 | NIST | Voluntary Govern, Map, Measure, Manage framework widely used for the systems model risk guidance leaves out. | Voluntary |
| NIST AI 600-1 (Generative AI Profile) | NIST | Twelve generative-AI risks with suggested actions mapped to the AI RMF. | Voluntary |
What examiners ask for
What do examiners ask to see in a model risk management review?
The evidence trail the guidance describes: a model inventory with owners and materiality tiers; board-approved policies that define what a model is and who does what; development documentation that an outsider could follow; validation reports covering conceptual soundness, outcomes analysis and ongoing monitoring; the record of issues, exceptions and limits on model use; due diligence and performance evidence for vendor models; and internal audit's assessment of the framework. The 2026 guidance says it sets no enforceable standards and that non-compliance will not by itself draw supervisory criticism, so the conversation is about whether practices are sound for the bank's risk, not about a checklist.
| What is requested | What it shows | Basis in the guidance |
|---|---|---|
| Model inventory with owners, purpose, status and materiality tier | That the bank knows what it runs and where its model risk concentrates, per model and in aggregate | SR 26-2 'Model Inventory'; SR 11-7 Section VI |
| Model risk policy and procedures, with the definition of a model | Scope decisions: what is in the inventory, what left it under the 2026 definition, and how generative AI is governed outside it | SR 26-2 'Governance and Controls' and footnote 3 |
| Development documentation and testing evidence | Purpose, design, data and assumptions are stated and the developmental evidence supports them | SR 26-2 'Model Development'; SR 11-7 Section IV |
| Validation reports and ongoing-monitoring results | Independent, expert challenge took place and performance is tracked against thresholds | SR 26-2 'Model Validation and Monitoring'; SR 11-7 Section V |
| Issue, exception and model-use-limit log | Findings lead to change: recommendations, responses and exceptions are tracked to closure | SR 26-2 'Documentation'; SR 11-7 Section VI (authority to restrict model use) |
| Vendor model files | The bank understands the vendor model's design, data and performance and validates its own use of it | SR 26-2 'Vendor and Other Third-Party Products'; SR 23-4 |
| Internal audit reports on model risk management | The third line has tested whether practices are rigorous and policies are followed | SR 26-2 'Roles and Responsibilities'; SR 11-7 Section VI |
SOURCES: SR 26-2 attachment: revised guidance (PDF) ↗ · SR 11-7 attachment (PDF) ↗ · OCC Bulletin 2026-13 ↗
By authority
Which model risk documents has each authority published?
Timeline
| Date | Event | Document |
|---|---|---|
| Apr 17, 2026 | SR 26-2 / OCC 2026-13 / FIL-15-2026 replace the 2011 guidance; generative and agentic AI out of scope | SR 26-2 |
| Nov 24, 2025 | PRA publishes its AI/ML model-risk roundtable slides | PRA AI/ML model-risk roundtable (Nov 2025) |
| Jul 28, 2025 | ECB Guide to internal models adds a machine-learning section | ECB Guide to internal models (July 2025, ML section) |
| Jun 7, 2023 | Interagency third-party risk guidance covers vendor models | SR 23-4 |
| May 17, 2023 | PRA SS1/23 published: five model risk principles, AI inside the perimeter | PRA SS1/23 |
| Mar 16, 2022 | Basel Committee newsletter on AI and machine learning | BCBS AI/ML Newsletter (March 2022) |
| Apr 9, 2021 | Interagency statement applies model risk principles to BSA/AML systems | 2021 BSA/AML Model Risk Statement |
| Mar 31, 2021 | Interagency request for information on banks' use of AI, including model risk questions | 2021 Interagency AI RFI |
| Apr 4, 2011 | SR 11-7 / OCC Bulletin 2011-12: Supervisory Guidance on Model Risk Management | SR 11-7 |
| May 20, 1997 | OCC Bulletin 1997-24: first examination guidance on credit scoring models | OCC Bulletin 1997-24 |
At the banks
Which of the 120 largest US banks have disclosed model risk work on AI?
97 of the 120 bank pages on this site record a model-risk activity tied to AI. Each links to the bank's page, where the claim is sourced.
| Bank | What the record shows | Status |
|---|---|---|
| JPMorgan | AI in model risk management and the 10-K risk factor: Models 'including those based upon machine learning or artificial intelligence techniques' sit inside estimations and model risk management; the 10-K names generative and agentic AI failures, bias, transparency and evolving AI law as risks. | In production |
| BofA | AI risk factors and model governance: The 10-K covers autonomous AI agents, third-party AI models with limited visibility into training data, inaccurate outputs and bias, and says models may be ineffective if AI applications 'are not developed and trained properly or contain biases'. | In production |
| Citi | AI risk factor and board oversight: The 10-K's AI risk factor covers generative AI, autonomous agents, explainability, bias and third-party models; the board's Technology Committee reviews management's approach to generative AI. | In production |
| Wells Fargo | AI risk-factor disclosure: The 10-K says AI helps inform or automate decisions, risk management and models, and names biased outputs and model opacity as risks. | In production |
| Goldman | AI risk factor and Firmwide AI Risk Committee: 10-K risk factor on generative-AI output, bias, opacity and third-party models; oversight by a committee co-chaired by the CIO and chief risk officer. | In production |
| Morgan Stanley | Generative AI in the 10-K risk factors: Cyber, operational, competitive and regulatory risk from generative AI; risk models may not keep pace with new technology. | In production |
| U.S. Bank | AI and machine-learning model risk (10-K): Models built on AI or machine learning bring 'the potential for algorithmic bias, and the need for greater explainability'; flawed or biased datasets named as a risk. | In production |
| Capital One | AI and model risk in the 10-K: The 2025 10-K names models and AI in pricing, fraud detection, loan grading, credit decisions and software development as a risk, plus agentic-commerce fraud and AI intellectual-property uncertainty. | In production |
| PNC | AI model-risk disclosure (10-K): AI/machine-learning models are a minority of PNC's models but increasingly used with customers and for internal automation; the 10-K names their complexity and the laws that govern them. | In production |
| Truist | AI risk management on the NIST AI RMF: 10-K AI risk factor on flawed, biased or degraded models and third-party AI services; the AI program is based on the NIST AI Risk Management Framework Core with board and committee oversight. | In production |
| Schwab | AI in the model risk framework: Policies, standards and controls on AI models, cross-functional review before any AI use, a rated model inventory and independent validation. | In production |
| BNY | Model risk management for AI and LLMs: An active model inventory and independent validation extended to AI use cases, including large language models, within a cross-functional AI risk framework. | In production |
| State Street | AI under the model risk management framework: 10-K: AI, generative AI and machine-learning models automate or enhance business processes, and AI and ML models used in regulatory capital must comply with the MRM framework; the Q2 2026 10-Q flags frontier-AI cyber risk. | In production |
| TD | AI risk management under the model lifecycle: Annual report: AI models (including ML and generative AI) meet the same model-risk standards; a three-lines-of-defense approach to AI risk; generative and agentic AI adoption by TD and its vendors named as a risk. | In production |
| Fifth Third | AI risk-factor disclosure: 10-K: internally built and third- or fourth-party AI could significantly affect the effectiveness of internal controls; AI raises cyber-attack risk. | In production |
| Huntington | AI risk factor, AI Risk Committee and board oversight: 10-K risk factor on flawed, biased or misleading model output and evolving AI law; a management AI Risk Committee; board Technology Committee oversight of AI strategy and implementation. | In production |
| BMO | AI risk directive, Responsible AI Forum and model validation: Life-cycle standards for every AI initiative; significant initiatives reviewed by a cross-functional forum; all models using AI subject to validation and monitoring. | In production |
| First Citizens | AI risk-factor and regulatory disclosure: 10-K covers third-party model development risk, generative-AI errors, bias and data leakage, explainability and documentation, and evolving federal and state AI law. | In production |
| Citizens | AI in the 10-K risk factors: Generative AI and LLMs as an information-security risk; AI as a potentially transformative competitive change. | In production |
| Amex | AI risk-factor disclosure: 10-K covers agentic-commerce disintermediation, flawed or biased models, hallucinations and the EU AI Act and US state AI laws. | In production |
| M&T | AI Risk Oversight (second line): Independent oversight program for responsible AI adoption. AI risk-factor disclosure: 10-K covers evolving AI law, erroneous or biased output, explainability, third-party model dependence and AI-enabled fraud. | In production |
| KeyBank | AI risk-factor disclosure: The 10-K covers third-party AI, flawed or biased training data, limited transparency of models, evolving AI law, and AI/ML models' need for large training datasets and difficulty of interpretation. | In production |
| Ally | AI risk-factor disclosure: The 10-K covers incorrect or biased output from generative AI and agents, explainability, third-party and frontier-model dependence, and fragmented state AI law; model validation staff include AI specialists. | In production |
| Northern Trust | AI Risk Program and model-risk coverage of AI: A dedicated program to identify, assess and monitor AI risk; AI and ML models get risk-based governance, independent validation and ongoing monitoring. | In production |
| HSBC | AI in the US model-risk and risk-factor framework: The 10-K says more sophisticated AI modelling could increase model risk, for which capital is held; a CRO-chaired Model Risk Committee manages model risk and the Model Risk Management function approves models used in HSBC North America. | In production |
| Regions | AI and machine-learning model risk (10-K): Stand-alone AI risk factor plus machine-learning models used in pricing, loan grading, fraud prevention, authentication and lead prospecting. | In production |
| Pinnacle | AI and complex-model risk disclosure: 10-K and 10-Q risk factors on accuracy, bias, explainability and compliance of AI and complex models, and on third-party AI dependence. | In production |
| UBS | AI inside the model-risk framework: The 20-F says AI-based solutions may rely on models, that AI-specific risks are managed alongside other risk frameworks, and that data quality may cause errors in machine-learning and AI tools. | In production |
| Santander | AI risk-factor disclosure: The 10-K covers flawed or biased models, poor-quality training data, misleading outputs from third-party AI and AI-enabled cyberattacks. | In production |
| City National | Emerging-technology risk in RBC's annual report: RBC's 2025 MD&A says the adoption of AI, including GenAI, calls for continued focus and investment to manage risks, alongside City National's three-lines-of-defence rebuild. | In production |
| Western Alliance | AI risk-factor disclosure: The 2025 10-K covers third- and fourth-party AI, hallucinations, bias, data leakage, IP infringement and the opacity of generative and agentic models, plus AI-driven cyber exposure. | In production |
| Zions | AI risk-factor disclosure and Data and AI Governance Committee: Human oversight of all final actions; bias, transparency and privacy reviews of models; monitoring of third-party AI; explainable and auditable AI processes. | In production |
| Webster | AI risk-factor disclosure (2025 10-K): Covers evolving AI law, generative-AI output that is incorrect, biased or leaks confidential data, the limited transparency of AI models, AI in the modelling process ('hallucinatory' output) and AI-enabled fraud and cyber-attacks. | In production |
| First Horizon | AI risk factor and board oversight: The 10-K flags flawed, insufficient or biased datasets and non-transparent AI models; the board risk committee receives quarterly AI risk reporting from the CRO. | In production |
| East West | AI in the 10-K risk factors: A single mention, within the risk of failing to keep pace with technological change; no AI-specific risk factor or governance description. | In production |
| Old National | AI risk-factor disclosure: The 10-K covers AI, including digital employees and digital engineers, used by the bank and vendors: regulatory scrutiny, biased algorithms or datasets, IP and cyber risk, and poor implementation. | In production |
| UMB | AI oversight through the TOPS committee: Third-party and emerging-technology risk, including AI, overseen by a committee co-chaired by the CISO/CPO and the chief information, bank product and operations officer; AI named in privacy and operational risk factors. | In production |
| SouthState | Per-use-case model testing: Expert Q&A sets for accuracy, privacy, security, toxicity and jailbreaks; retested as models change. Formal AI Strategy and AI risk-factor disclosure: The 10-K records a formal AI Strategy with controls to maintain accuracy and reduce or eliminate bias, and lists errors, unfair treatment and fraud from AI use as risks. | In production |
| Columbia | AI risk-factor disclosure: The 10-K covers third- and fourth-party AI, evolving AI regulation, incorrect, leaky or biased generative-AI output, limited model transparency and AI-enabled fraud. | In production |
| CIBC | AI and ML in the model inventory; AI governance committees: Model-risk governance covers AI and ML models ahead of OSFI Guideline E-23 (May 2027); enterprise AI Governance and Risk Assessment Committees; third-party risk management covers AI-related risks. | In production |
| Valley | AI governance function and risk-factor disclosure: Risk assessment of internal and vendor AI, due diligence, model validation and controls; the 10-K flags errors, bias, unfair treatment and customer-service AI that fails to escalate to humans. | In production |
| BOK Financial | Per-initiative AI governance review (10-K risk factor): Each AI initiative is assessed for data quality, bias, regulatory compliance and ethical considerations; the board is updated periodically on the governance structure but does not approve individual capabilities. The same risks are flagged for third-party providers building AI into their services. | In production |
| Frost | AI risk factors in the 10-K: Unintended consequences from AI, automation and algorithms; AI adoption increasing cyber-attack exposure; AI enhancing criminals' ability to defeat fraud controls. | In production |
| FNB | Decisioning, forecasting and regulatory models: Data-science team under Tangirala maintains strategic decisioning systems and regulatory models. AI and generative-AI risk factor: The 10-K flags inaccurate or biased generative-AI output, dependence on data quality and model governance, third-party model training risk, and fair-lending, privacy and consumer-protection exposure. | In production |
| SoFi | AI risk-factor disclosure: 10-K: AI data and model liabilities, third parties' use of AI, hard-to-detect errors in machine-learning systems, AI-enhanced cyberattacks and California's automated-decision rules. | In production |
| Barclays US | Group AI and machine-learning risk factor: Barclays PLC's 20-F risk factor on generative and agentic AI and ML covers third-party providers' AI use and evolving AI law in Europe and certain US states. | In production |
| Raymond James | AI risk-factor disclosure and walled-garden controls: The 10-K names inaccurate or biased AI output, vendor practices, security and privacy risk and AI regulation, mitigated by proprietary 'walled-garden' environments. | In production |
| Associated | AI risk-factor disclosure: Reliance on AI, machine learning and automated decision making; third-party AI tools, data rights and fair-lending exposure. | In production |
| Prosperity | AI risk-factor disclosure: Generic 10-K risk factor covering the bank's and its vendors' possible use of AI and machine learning, biased data, opaque models and evolving AI regulation. | Announced |
| Bank OZK | AI risk-factor disclosure: The 2025 10-K covers AI used by the bank or its vendors to improve service and automate business decisions or risk management, uncertain AI law, opaque models, bias, explainability and third-party training data. | In production |
| Deutsche Bank | Agentic-AI risk factor and AI control framework: The 20-F says AI risk is incorporated into the control framework and flags hallucination, bias, explainability, data sovereignty and autonomous agents overriding safeguards. | In production |
| Atlantic Union | AI and machine-learning models in use: Disclosed in the 10-K with training-data, bias and interpretability risks. | In production |
| Hancock Whitney | AI model risk factor: Supervisory expectations on explainability for models incorporating AI; incorrect or biased generative output; third-party models. | Announced |
| BankUnited | AI risk factor: Flawed or biased data, opaque AI and machine-learning models, and AI in third-party vendors' products. | Announced |
| Banc of California | AI risk factor and AI-disruption credit screen: 10-K risk factor on third-party AI; tech-loan book screened for borrowers whose models AI could disrupt. | In production |
| United Bank | AI in the 10-K risk factors: AI as an amplifier of cyber-attacks and fraud, and the risk that the bank's own AI, automation and algorithms have unintended consequences. | Announced |
| Texas Capital | AI risk-factor disclosure and board technology oversight: The 10-K covers incorrect or biased generative-AI output, model opacity, evolving AI regulation and third-party model risk; a board Technology Committee formed in 2025 oversees technology and cyber risk. | In production |
| Fulton | AI risk-factor disclosure: The 10-K names AI, machine learning and automated decision-making as new technologies that may have unintended consequences, within the technology-change risk factor. | In production |
| Glacier | AI risk-factor disclosure: The 10-K covers AI disruption of the business model, implementation and maintenance costs, reputational harm, AI-enabled security threats, divergent state AI legislation, and models that may rely on AI applications. | In production |
| Eastern Bank | AI risk-factor disclosure: The 10-K says AI use is not currently material, and names flawed or biased datasets, non-transparent AI and machine-learning outputs, evolving AI regulation and third-party AI as risks. | In production |
| Axos Bank | AI risk-factor disclosure: 10-K covers agentic and generative AI, third-party model dependence, bias, explainability and evolving regulation. | In production |
| Sallie Mae | AI as a credit-risk variable: Management tracks AI's effect on graduate employment and cosigner strength, discussed on the January and April 2026 earnings calls and at RBC's March 2026 conference. AI risk-factor disclosure: The 10-K's dedicated AI risk factor covers evolving federal and state AI regulation, vendors' use of AI, inadvertent disclosure of confidential information and the opacity of AI models; the loss-forecasting models were rebuilt in 2023. | In production |
| United Community | AI risk-factor disclosure: The 10-K names AI and machine learning in the technology-change and competition risk factors, says AI and quantum computing could exacerbate fraud, and requires AI's cybersecurity risks to be analysed before implementation. | In production |
| Ameris | AI risk-factor disclosure: The 10-K flags errors, unfair treatment and fraud from AI used by the bank and its vendors, AI added by vendors without the bank's prior knowledge, and failures of model design, testing and human oversight. | In production |
| WaFd Bank | AI risk-factor disclosure: The 10-K names incorrect, biased or harmful outputs of generative and agentic models, limited transparency, evolving AI law and dependence on third-party models as risks. | In production |
| WesBanco | AI risk-factor disclosure: The 10-K treats competitors' adoption of AI as a reason the bank may need substantial new technology investment that may not earn the expected return. | In production |
| Renasant | AI risk-factor disclosure: Stand-alone 10-K risk factor on the bank's development and use of AI, including generative and agentic AI and machine learning: dependence on third-party models, faulty data, inadequate testing or human oversight, biased or incorrect outputs, limited explainability and uncertain regulation. | In production |
| First Interstate | AI risk-factor disclosure: Stand-alone 10-K risk factor: AI the bank develops or uses may be flawed, and deficient, biased or privacy-compromising AI (its own or third parties') could bring competitive, legal and reputational harm; AI regulation and IP rules are evolving. | In production |
| Customers Bank | AI risk-factor disclosure: The 10-K carries a standalone risk factor on evolving AI regulation and names AI disruption of borrowers' industries and AI-enabled hacking as risks. | In production |
| Rockland Trust | AI risk-factor disclosure: The 10-K's standalone AI risk factor covers regulatory uncertainty, incorrect or biased generative output, limited model transparency and third-party model dependence. | In production |
| Simmons Bank | AI risk-factor disclosure: 10-K risk factor on agentic AI, third-party model risk, uncertain AI regulation and incorrect or biased generative output. | In production |
| First Hawaiian | AI risk-factor disclosure: Stand-alone 10-K risk factor covering evolving AI regulation, incorrect or biased generative-AI output, model opacity, reliance on third-party models and AI-enabled fraud. | In production |
| Cathay Bank | Technology-change risk factor (no AI reference): The 10-K frames technology risk as implementation cost, disruption and better-resourced competitors, without mentioning AI; the Q2 2026 10-Q is also silent on AI. | In production |
| Bank of Hawaii | AI risk-factor disclosure: Stand-alone 10-K risk factor: evolving AI regulation, incorrect or biased generative-AI output, model opacity and reliance on third-party models. | In production |
| Centennial Bank | AI risk-factor disclosure: The 10-K's technology-change risk factor names AI, including generative AI, as a source of uncertain risks that may require investment in responsible-use frameworks; the forward-looking cautions list keeping pace with changes 'regarding cybersecurity and artificial intelligence'. | In production |
| First Financial Bank | AI risk-factor disclosure: A stand-alone 10-K risk factor on AI, generative AI, LLMs and AI agents, plus AI in the technology risk factor: data leakage, model bias, decision errors, regulatory non-compliance and ineffective governance. | In production |
| TowneBank | AI risk-factor disclosure: A stand-alone 10-K risk factor: evolving AI regulation, incorrect or biased generative-AI output, limited transparency of AI models, and dependence on third-party model developers. | In production |
| Beacon Bank | AI risk-factor disclosure: The 10-K says AI, automation and algorithms may have unintended consequences, including fraud or cybersecurity risk, 'due to their limitations, potential manipulation, or our failure to use them effectively'; AI is also named as a competitive and cyber-threat risk. | In production |
| Mechanics Bank | AI risk-factor disclosure: The 10-K says the company uses AI on a limited basis and that flawed algorithms, biased datasets or deficient AI-assisted analyses could bring competitive, legal and reputational harm; the board risk committee oversees technology and information-security risk. | In production |
| Seacoast Bank | AI risk-factor disclosure: The 10-K's dedicated AI risk factor covers incorrect or biased model outputs, limited transparency of third-party models, AI integration causing processing errors or conversion delays, and model drift in internal AI systems used for efficiency. | In production |
| First Merchants | AI risk factor and AI governance frameworks: The 2025 10-K names regulatory scrutiny, biased algorithms or datasets, output errors, weak control over third-party models' training data and updates, and data leakage as AI risks, and says governance, risk-management and control frameworks oversee AI use. | In production |
| Optum Bank | Group AI risk factor and responsible-AI policies: UnitedHealth's 10-K warns that AI systems producing inaccurate, incomplete or biased output could cause harm, flags emerging AI regulation and AI-enabled cyberattacks, and says policies and procedures promote the responsible design, development and use of AI. | In production |
| Central Bank | AI in 10-K risk factors and 10-Q risk monitoring: AI named as a source of implementation errors and fraud or cyber risk; the 2026 10-Qs report no material impact from AI-related fraud and cyber risks. | In production |
| Merchants Bank of Indiana | AI risk-factor disclosure: The 10-K lists lack of accountability and explainability, reliance on large volumes of data, potential bias, privacy, third-party, cybersecurity and consumer-protection concerns as risks of AI adoption. | In production |
| Stifel Bank | AI risk management framework: Centralised AI inventory, risk-based classification, guardrails and monitoring requirements before deployment; policies on associates' and vendors' AI use. | In production |
| Bank of Hope | AI risk-factor disclosure: The 10-K describes AI as a possible future capability and lists regulatory, bias, transparency, confidentiality and third-party-model risks. | Announced |
| ServisFirst Bank | AI-enabled tools in financial-reporting controls: Used to support identification, validation and consistent classification of cash-flow activities after a material weakness; remediation tested and concluded effective as of 30 June 2026. | In production |
| Busey Bank | AI and generative-AI risk factors: 10-K risk factors on rapid AI adoption, generative-AI impersonation and fraud, model governance, vendor AI and AI-specific privacy regulation. | In production |
| Community Bank N.A. | AI and data governance framework and AI risk factor: AI solutions go through formal approval, validation and periodic re-validation proportional to their risk, with a human in the loop for higher-risk uses; the 10-K warns of 'biased or incorrect model outputs' and of uncertainty about the accuracy and relevance of AI outputs. | In production |
| Enterprise Bank & Trust | AI in the 10-K risk factors: AI appears as a driver of technology change the bank must keep up with and as a factor making cyberattacks more sophisticated; the filing describes no AI-specific governance. | In production |
| FirstBank | AI risk factor: AI tools 'may produce inaccurate, incomplete, biased, or misleading outputs that can be difficult to validate or explain'; reliance without human oversight could cause errors, customer harm or fair-lending issues; AI can enable more sophisticated fraud and phishing. | In production |
| Banner Bank | AI risk-factor disclosure: The 10-K flags model risk, biased data, black-box explainability, data poisoning and disruption to AI-supported fraud detection, transaction monitoring and client support. | In production |
| NBT | SDLC and model validation for AI tools: Internally developed AI-enabled tools are evaluated through the Solutions Development Lifecycle, including model validation and other risk controls. | In production |
| Live Oak | AI risk factor and risk framework: The 10-K describes risks of automated decision-making errors, third-party model opacity and biased data, and an effort to evolve the risk framework for AI. | In production |
| Hilltop | AI implementation risk in internal controls: The 10-K warns that implementing AI, machine learning and large language models may bring unintended consequences and operational and internal-control risk. | In production |
| First Commonwealth | Controls on AI and algorithms: The 10-K says implementing AI and algorithms in business processes may have unintended consequences due to their limitations or ineffective use. | Announced |
| The Bancorp | AI opacity and bias risk: The 10-K flags that the complexity of AI models limits transparency, making erroneous output, bias and regulatory explanation harder to manage. | Announced |
Common questions
What is model risk?
Model risk is the potential for adverse consequences from decisions based on a model that is wrong or is used in the wrong way. The 2011 US guidance named two sources: a model may have fundamental errors and produce inaccurate outputs, or it may be used incorrectly or outside its limitations. The 2026 guidance adds that the magnitude of model risk reflects a model's inherent risk together with its materiality, meaning its exposure and purpose, and that risk should be assessed for each model and in aggregate.
Is SR 11-7 still the model risk management standard?
No. SR 11-7 and OCC Bulletin 2011-12 were replaced on April 17, 2026 by SR 26-2, OCC Bulletin 2026-13 and FDIC FIL-15-2026. The structure they established carries over; the definition of a model, the scaling to materiality and the treatment of generative AI changed.
What is a model risk management policy?
The board-approved document that defines what counts as a model, sets the tiering method, assigns roles across model owners, validators and internal audit, fixes validation and monitoring expectations by tier, and governs vendor models, exceptions and reporting. The 2011 guidance expected the board or its delegates to approve model risk policies and review them annually.
Does model risk management cover generative AI?
Not in the US guidance. SR 26-2 says generative AI and agentic AI models are not within its scope and leaves their controls to the bank's broader risk management and governance practices, while non-generative machine-learning models stay in scope. In the UK, SS1/23 keeps AI and machine learning inside model risk management.
Which banks does the US model risk guidance apply to?
All banking organisations supervised by the Federal Reserve, OCC and FDIC, but the agencies expect it to be most relevant to those with more than $30 billion in total assets, and to smaller banks only where model use is prevalent and complex or activities go beyond traditional community banking.
Which of the largest US banks have disclosed model risk work on AI?
Only a handful say so publicly. The bank pages on this site record a second-line AI risk oversight programme at M&T, per-use-case model testing at SouthState and 10-K disclosure of AI model risks at Atlantic Union, among others; the table above lists each with its source.
Compare
How does model risk guidance compare?
- SR 11-7 vs SR 26-2 — What Changed in Bank Model Risk Guidance
- PRA SS1/23 vs SR 26-2 — UK and US Model Risk Compared
Model risk in the daily brief
Oct 10, 2026Anthropic turns off internet access for internal AI evaluationsOct 9, 2026OnDeck automates small-business loan approvalsOct 7, 2026Plaid launches credit, fraud and payment risk AI modelsOct 6, 2026Texas Capital Bank demonstrates AI agent ledger commits and reversalsOct 5, 2026Aleph Alpha releases 78B-parameter Kolibri AI modelOct 3, 2026AWS releases open-source Strands Decider 2B
Navigate
When model risk guidance moves, you'll read it the next morning.
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am ET · free
plus every tracker, bank and agent page update, the morning after · leave any morning