TL;DR

  • SR 11-7 is gone: On 17 April 2026, the Federal Reserve, the OCC, and the FDIC jointly rescinded SR 11-7, the 2011 guidance that shaped US bank model risk management for 15 years.
  • The replacement is narrower: SR 26-2 and OCC Bulletin 2026-13 set no enforceable standard. The agencies say non-compliance “will not result in supervisory criticism,” and the guidance is written mainly for banks holding more than $30 billion in assets.
  • Generative and agentic AI models are explicitly excluded: the new guidance calls them “novel and rapidly evolving” and defers them to a separate guidance the agencies have promised but not issued.
  • Examiners have not stopped asking: reporting on Federal Reserve Vice Chair Michelle Bowman’s public remarks makes clear that examiners still expect a bank to show its monitoring and testing approach for these models, letter or no letter.
  • The honest caveat: the $30 billion threshold marks where the guidance is “most relevant.” It does not mark where the guidance stops applying. A smaller bank running material model risk is still on the hook for the underlying expectation, without a document that spells it out line by line.

For 15 years, a bank building an AI governance monitoring program had one reference document to build it against. SR 11-7 named the questions an examiner would ask: is the model doing what it was built to do, is someone checking, and can the bank prove it. That document does not exist anymore.

On 17 April 2026, the Federal Reserve, the Office of the Comptroller of the Currency, and the FDIC jointly rescinded SR 11-7 and replaced it with SR 26-2 and OCC Bulletin 2026-13. The replacement changes three things a risk or compliance team has to react to: what counts as a model, what the regulator will enforce, and which models the guidance covers at all. Generative and agentic AI, the categories most banks are now deploying fastest, sit outside it.

This piece works through what changed, why the models iTuring’s own platform runs under, generative AI and agentic AI, fall into the gap the new guidance leaves open, and what a governance monitoring program has to do about that gap regardless of what a regulator currently requires on paper.

SR 11-7 governed AI model risk for 15 years. It doesn’t anymore.

SR 11-7, issued 4 April 2011, is the document most US banks built their model risk management function around, model inventories, independent validation, ongoing monitoring, and board oversight, all traced back to its three core principles. On 17 April 2026, the Federal Reserve, OCC, and FDIC rescinded it and issued joint replacement guidance: SR 26-2 on the Fed’s side, OCC Bulletin 2026-13 on the OCC’s.

A horizontal timeline with three points. The first, dated 4 April 2011, reads "SR 11-7 issued." The second, dated 17 April 2026, reads "SR 11-7 rescinded." The third reads "SR 26-2 and OCC Bulletin 2026-13 take effect. Generative and agentic AI excluded."

The replacement keeps the shape of model risk management (development, validation, deployment, monitoring) but changes what it asks of a bank. SR 11-7 required independent validation at least annually, with no exceptions written in. SR 26-2 and OCC Bulletin 2026-13 remove that fixed cadence and let each institution set its own validation schedule based on its own risk profile. The agencies describe the new approach as focused on “sound principles for effective model risk management.” They say directly that the guidance “does not set forth enforceable standards or prescriptive requirements.”

That distinction matters for who the guidance is written to reach. The agencies say it is “expected to be most relevant to banking organizations with over $30 billion in total assets,” a threshold SR 11-7 never had. A community bank or credit union below that line is not automatically exempt. The guidance itself notes it can still apply to smaller institutions “that have significant exposure to model risk because of the prevalence and complexity of their models,” which covers most banks now running AI in credit decisioning, fraud detection, or collections.

A two-column comparison table. Left column, SR 11-7: treated as a supervisory standard, at least annual validation, no asset threshold, silent on generative or agentic AI. Right column, SR 26-2 and OCC Bulletin 2026-13: not enforceable, validation cadence set by the institution, most relevant above $30 billion in assets, explicitly excludes generative and agentic AI.

Generative and agentic AI models are explicitly outside the new guidance

The new guidance does not cover the AI models banks are adopting fastest. SR 26-2 and OCC Bulletin 2026-13 name generative AI and agentic AI directly and put them outside scope, calling both “novel and rapidly evolving.” The agencies have said separate guidance or rulemaking will address AI-specific risk, but as of this writing, that guidance has not been issued.

This is not a gap the agencies are hiding. Sullivan & Cromwell’s analysis of the joint guidance states plainly that these tools “stay under the risk management and governance expectations that apply to banking organizations in general” even without a model-risk-specific letter to point to. In other words, a generative AI tool summarizing loan files or an agentic system routing collections outreach is not exempt from oversight. It has lost the one document that told a bank exactly what oversight had to look like.

Reporting on Fed Vice Chair Michelle Bowman’s remarks after the rescission describes examiners asking two questions regardless of the scope gap: what monitoring and testing framework a bank uses for its generative and agentic AI, and what its effective challenge process looks like. Neither question has a prescribed answer format anymore. Both still get asked.

Practically, this means a bank cannot point to a rescinded letter and call its generative AI governance complete, and it cannot wait for the promised future guidance before building a monitoring program either. The obligation moved from a specific document to a general standard, which is a harder standard to satisfy with a checklist and a much easier one to fail quietly.

What AI governance monitoring means

AI governance monitoring is the ongoing, post-deployment tracking of a model’s behavior, performance, and compliance against the standard it was approved under, paired with a record of who reviewed that tracking and when. It is distinct from validation, which happens before and during deployment to confirm a model is fit for use. Monitoring happens after go-live, continuously, for as long as the model is in production.

For a model already running in a bank’s environment, that tracking covers a small set of recurring questions:

Is the model still doing what it was approved to do. Performance metrics, AUC, precision, recall, and similar measures depending on the model type, are read against the thresholds set at approval. A new baseline that nobody signed off on does not count.

Has the data underneath it moved. Feature drift and data drift readings catch a model that is technically unchanged but scoring against a population or set of inputs that has shifted since validation.

Is the output distribution stable. A model producing a materially different mix of outcomes than it did at approval, more declines, different risk tiers, a new concentration in one segment, needs a human to ask why before the shift compounds.

Can someone show the evidence later. A monitoring result that lives in a dashboard nobody archived is not evidence. It has to be retained in a form an examiner, or an internal auditor, can pull up months later against the specific model version that produced it.

Generative and agentic AI models add questions the traditional list does not cover on its own: hallucination rate under production conditions, whether the system’s outputs stay inside its intended task boundary, and whether an autonomous action taken by an agent can be traced back to the decision logic that triggered it. None of these questions are answered by the old SR 11-7 checklist, and none of them are answered by the new principles-based guidance either, since both were written for a narrower category of statistical and quantitative models.

This piece covers the enterprise-wide monitoring question, across every model a bank runs. A team monitoring collections AI models specifically, with a narrower set of metrics and champion-challenger testing already mapped in detail, has a dedicated operational walkthrough to work from instead.

What examiners still expect without a checklist

An examiner without a prescriptive letter to cite will still ask a bank to demonstrate ownership, evidence, and a functioning challenge process for every model in production, generative and agentic AI included. The absence of a specific rule has not translated into an absence of scrutiny. It has shifted the burden from following a checklist to proving a program.

Three things a bank needs on hand, drawn directly from what examiners are reportedly asking for:

  • A named owner for every model outside the new guidance’s formal scope. If a generative AI tool or an agentic workflow is in production, someone specific is accountable for its monitoring. An abstract team is not enough.
  • A documented monitoring and testing framework, covering what gets measured, how often, and what triggers a review, even where no regulation mandates the specific cadence.
  • A file an examiner can read. Monitoring results, review dates, and any corrective action taken need to sit somewhere retrievable, tied to the model version they describe. Scattered engineering tickets and Slack threads do not qualify.

A checklist card with three items. A named owner for every model outside formal scope. A documented monitoring and testing framework. A file an examiner can read.

None of this is complicated in principle. It becomes a real project the moment a bank tries to produce it under time pressure, during an exam, for a model built eighteen months ago by a team that has since turned over.

Building governance into the platform before deployment

The instinct after a rule gets loosened is to loosen the internal program along with it. That instinct is backwards here. A principles-based standard with no prescribed format asks a bank to design its own evidence trail from scratch, which is harder than following someone else’s checklist.

iTuring’s Model Gov module keeps that evidence trail running by default. There is nothing to reconstruct at exam time. Every model version carries an immutable audit trail: who approved it, on what evidence, and under what monitoring thresholds, through a maker-checker approval workflow that separates the person building a model from the person clearing it for production. Monitoring runs continuously against the thresholds set at approval, generative and agentic AI models included, so the drift and output-stability questions above are answered by a running record that updates on its own schedule.

That structure is what let one client, a leading NBFC in India, produce a 116% improvement in collections recovery and 86% predictive accuracy within a two-week deployment window, with the audit trail behind every scored account intact from day one. Regulatory scope changes. The requirement to show your work does not.

A regulatory floor moved out from under a document banks had relied on for 15 years, and the models growing fastest in production, generative and agentic AI, were never covered by it in the first place. Building the monitoring and audit trail now, before an examiner asks for it, is a better position than reconstructing one under deadline. This piece sits inside iTuring’s broader AI Governance Solutions for Regulated Financial Institutions resources, covering governance, validation and monitoring together. Book a working session with iTuring to see what a governance record that survives an exam looks like.

Sources

  • SR 26-2: Revised Guidance on Model Risk Management, Board of Governors of the Federal Reserve System, 17 April 2026. https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm
  • Model Risk Management: Revised Guidance, OCC Bulletin 2026-13, Office of the Comptroller of the Currency, 17 April 2026. https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-13.html
  • SR 11-7: Guidance on Model Risk Management, Board of Governors of the Federal Reserve System, 4 April 2011 (rescinded 17 April 2026). https://www.federalreserve.gov/supervisionreg/srletters/sr1107.htm
  • Federal Banking Agencies Issue Revised Guidance on Model Risk Management, Sullivan & Cromwell LLP, April 2026. https://www.sullcrom.com/insights/memo/2026/April/OCC-Fed-FDIC-Issue-Revised-Guidance-Model-Risk-Management
  • Updated Interagency Guidance on Model Risk Management, Baker Tilly, April 2026. https://www.bakertilly.com/insights/updated-interagency-guidance-on-model-risk-management
  • Visual memo: Key changes under the federal banking agencies’ revised model risk management guidance, Davis Polk, April 2026. https://www.davispolk.com/insights/client-update/visual-memo-key-changes-under-federal-banking-agencies-revised-model-risk
  • Banks Lost Their Model-Risk Letter for Agentic AI. Examiners Will Still Ask., MightyBot, 2026. https://mightybot.ai/blog/banks-lost-model-risk-letter-agentic-ai/
  • Improve Collections and Optimize Efforts (case study), iTuring.ai. https://ituring.ai/case-study/improve-collections-and-optimize-efforts/