Regulation, United States
SR 26-2 and what changed from SR 11-7
SR 26-2, a letter dated 17 April 2026, issues the Revised Guidance on Model Risk Management from the Federal Reserve, the OCC and the FDIC. It supersedes and replaces SR 11-7 (2011) and SR 21-8 (2021). It is guidance: its attachment says it does not set forth enforceable standards or prescriptive requirements.
Read at the Federal Reserve’s own pages on 21 October 2026.
The letter, in brief
- Dated
- 17 April 2026 (the letter)
- Issued by
- The Board of Governors of the Federal Reserve System, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation
- Supersedes
- SR 11-7, Guidance on Model Risk Management (4 April 2011), and SR 21-8, the interagency statement on model risk management for BSA/AML systems (9 April 2021)
- Most relevant to
- Banking organizations with over $30 billion in total assets
- Effective date
- The letter and the attachment state none; the letter is dated 17 April 2026
Who it is for
The letter says it is “expected to be most relevant to banking organizations with over $30 billion in total assets regulated by the Federal Reserve.” The attachment generally excludes banks at or below that size, and adds that the guidance may also be relevant to smaller banks with significant exposure to model risk because of the prevalence and complexity of their models (attachment, section II). SR 11-7 applied to all banking organizations the Federal Reserve supervises, scaled to their size and complexity.
On AI, the attachment is explicit: generative AI and agentic AI models are not within its scope, and its principles apply to traditional statistical and quantitative models and to non-generative, non-agentic AI models.
What changed from SR 11-7
This list comes from comparing the two texts; the agencies give the reason as supervisory experience, industry feedback and advances in modeling.
- The definition of a model now reads “a complex quantitative method, system, or approach”, and excludes spreadsheet arithmetic and deterministic rule-based processes and software.
- Tone: SR 11-7 set out supervisory expectations; SR 26-2 says non-compliance with it will not result in supervisory criticism, though action may follow violations of law or unsafe practices.
- Validation is judged by the rigor and effectiveness of the review rather than by organizational structure, and the “at least annually” review of SR 11-7 is gone.
- Governance delineates the individuals responsible for key activities across the model lifecycle; the board of directors and senior management are no longer named.
- The model inventory is described as common industry practice, with no list of contents, where SR 11-7 said organizations should maintain one.
- Vendor and third-party products have their own section, without SR 11-7’s vendor evidence and contingency-plan sentences.
- Length: the attachment is 12 pages; SR 11-7’s was 21.
What it says about a model inventory
“It is common industry practice for banking organizations to maintain a comprehensive set of information for models under development or in use to support effective model risk management.” An effective inventory, the attachment says, “includes sufficient information to understand model risks, so as to support effective model risk management at the individual and aggregate levels” (attachment, section VI).
How GovernanceOS™ helps
- Each gate on a GovernanceOS record names one approver and hashes the evidence at that moment, so the individuals responsible across the model lifecycle are on the record, by design. How it works
- Check a register, free, in your browser: SR 26-2 lists no inventory fields, so goslint has no pack for it; its US packs cover the NIST AI RMF Playbook (GOVERN 1.6), the NIST Generative AI Profile and Colorado’s insurance rule.
- The SR 26-2 row, with the date it was last checked, among the US rows.
Conformance with any framework is self-declared.
Questions
Questions about SR 26-2.
Does SR 26-2 replace SR 11-7?
Yes. The letter dated 17 April 2026, issued by the Federal Reserve, the OCC and the FDIC, supersedes and replaces SR 11-7, Guidance on Model Risk Management (2011), and SR 21-8, the interagency statement on model risk management for BSA/AML systems (2021). It carries the Revised Guidance on Model Risk Management as its attachment.
Does SR 26-2 cover AI models?
In part. The attachment says its principles apply to traditional statistical and quantitative models and to non-generative, non-agentic AI models. Generative AI and agentic AI models are not within its scope; for those, a bank’s own risk management and governance practices should guide the governance and controls, the attachment says.
Who does SR 26-2 apply to?
The letter says it is expected to be most relevant to banking organizations with over $30 billion in total assets regulated by the Federal Reserve. The attachment generally excludes smaller banks, but notes it may also be relevant to banks at or below $30 billion with significant exposure to model risk from the prevalence and complexity of their models.
When does SR 26-2 take effect?
Neither the letter nor its attachment states an effective date or a transition period; the letter is dated 17 April 2026. The attachment says it does not set forth enforceable standards or prescriptive requirements, and that non-compliance with it will not result in supervisory criticism, though action may follow violations of law or unsafe practices.
Does SR 26-2 require a model inventory?
It describes one as common industry practice: a comprehensive set of information for models under development or in use. An effective inventory, it says, includes sufficient information to understand model risks at the individual and aggregate levels. Unlike SR 11-7, it lists no inventory contents and names no firm-wide owner for the inventory.