TL;DR
- SR 26-2 explicitly excludes generative and agentic AI models from its scope. The Federal Reserve calls them “novel and rapidly evolving” and defers them to separate guidance with no date given.
- That exclusion does not mean your AI models go ungoverned. Examiners keep asking what monitoring and effective-challenge process a bank runs for its AI models, scope gap or not.
- AI model governance has to cover things traditional model governance doesn’t. Prompt and output drift, hallucination boundaries, and a model that changes behavior without a retrain all need a different kind of evidence.
- Waiting for SR 26-2’s AI-specific guidance means waiting for a date the regulator hasn’t set. The agencies have said separate guidance is coming, with no timeline attached.
- A short checklist separates a bank ready for an examiner’s question from one that isn’t. Five items, covered below.
- This piece covers the AI-specific gap in model governance. Read Model Governance in Banking: Ownership, Approval, and Retirement for the ownership, approval, and retirement mechanics that apply across a bank’s whole model portfolio, AI and traditional alike.
A bank that recently finished mapping its model governance program to SR 26-2 has good reason to feel current. It should not feel finished. The guidance that replaced SR 11-7 in April 2026 is explicit that generative and agentic AI models sit outside its scope for now, deferred to guidance the agencies have promised but not dated. Examiners have not waited for that guidance to start asking questions. The gap between what the regulation formally requires and what a bank needs to show is where AI model governance lives. This piece covers that gap: what SR 26-2 does and does not say about AI models, what examiners ask anyway, and what a governance program for those models has to include.
What SR 26-2 excludes, and why it does not mean AI models go ungoverned
SR 26-2, the Federal Reserve’s April 2026 replacement for SR 11-7, was written for the kind of model SR 11-7 already understood: statistical and machine learning models built on defined inputs, trained once, then monitored for drift against a known baseline. Generative and agentic AI postdate SR 11-7 entirely, and the new guidance says so directly, calling both categories “novel and rapidly evolving” and stating that governing them fully will require separate guidance or rulemaking still to come.
That is a scope decision. It says nothing about how much risk these models carry. A large language model summarizing loan documents or an agentic system routing collections outreach makes decisions that affect customers the same way a credit score does. The absence of a prescribed rule for how to govern it doesn’t remove the bank’s exposure if that model produces a wrong or biased outcome. It means the bank has to build the governance itself, without a checklist to follow.
Why examiners keep asking about models the guidance does not require you to govern
Reporting on Federal Reserve Vice Chair Michelle Bowman’s public remarks after the SR 26-2 rescission confirms what many banks are already finding in exam rooms: examiners continue to ask what monitoring and testing framework, and what effective-challenge process, a bank runs for its generative and agentic AI models, regardless of the formal scope gap. A separate 2026 industry guide covering the same rescission puts the pattern plainly, describing GenAI as “formally out of scope” while noting that supervisors and internal audit are “already applying MRM expectations by analogy” to systems like AI underwriting assistants and customer-facing copilots.
This is not examiners exceeding their mandate. SR 26-2 disclaims enforceable standards for everything it covers, AI models included, and examiners have never needed a model-specific rule to ask a bank how it knows a system is working as intended. A bank that treats the scope exclusion as permission to skip governance for its AI models is answering a narrower question than the one an examiner is going to ask.
What AI model governance has to cover that traditional model governance does not
A traditional model’s governance program answers a fixed set of questions well: what data trained it, how it was validated, what its approval history looks like, when it was last revalidated. Those questions still apply to an AI model, but they don’t cover everything an AI model does differently.
Output drift without a retrain. A traditional model’s behavior changes when it’s retrained on new data, a discrete, documented event. A large language model’s outputs can shift because of a prompt change, a new system instruction, or an update to the underlying foundation model your vendor pushed without asking. Governance has to track behavior changes that happen outside the retrain cycle traditional monitoring is built around.
Hallucination and confidence boundaries. A traditional model returns a number with a known error distribution. A generative model can return a fluent, wrong answer with no signal that it’s wrong. Governance has to define where a hallucination is tolerable, where it isn’t, and what compensating control catches it before a customer or an examiner sees it.
Autonomous action beyond a score. An agentic system does more than predict. It acts, sending an email, adjusting an offer, routing a case, sometimes chaining several of those actions together. Governance for a model that acts has to account for what it did, in addition to what it predicted, a different audit trail than the one built for scoring models.
Vendor-side changes you don’t control. A foundation model your institution licenses can change behavior when the vendor updates it, on the vendor’s schedule. Traditional model governance assumes the institution controls when a model changes. AI model governance has to plan for change it doesn’t control.
Building a governance program for models the regulation has not defined yet
The instinct to wait for SR 26-2’s promised AI-specific guidance is understandable and costly. The agencies haven’t given a date, and a bank running generative or agentic models today is being asked, in practice, to answer for them today.
The workable approach is to extend the existing model risk management discipline to AI models by analogy, the same approach reporting suggests examiners are already taking. That beats standing up a separate governance track and waiting years for a rule to formalize it. It means classifying AI models by risk tier the same way traditional models are classified, naming an accountable owner the same way SR 26-2 requires for every model in scope, and building monitoring evidence for the AI-specific failure modes above into the same audit trail a validator or examiner already expects to see.
This isn’t a compliance workaround. It’s the same logic the guidance itself uses for everything it does cover: proportional oversight built on actual risk, applied before a rule exists to demand it.
A short checklist: is your AI model governance ready for a question SR 26-2 does not force you to answer
- A named accountable owner for every generative or agentic AI model in production, tracked the same way SR 26-2 requires for models formally in scope.
- A risk tier assigned to each AI model based on what it does and who it affects, beyond the category it falls into.
- Monitoring evidence for output drift, hallucination rate, and confidence boundaries, refreshed on a cadence that matches how often the model’s behavior can change.
- A documented process for a vendor-pushed model update, including how the bank finds out about it and what re-validation follows.
- An audit trail for what an agentic model did, in addition to what it predicted, produced as a byproduct of how the model runs and ready before an examiner has to ask for it.
A bank missing two or more of these is governing its AI models to a lower standard than the one an examiner is likely to apply, whatever SR 26-2 formally requires today.
How iTuring governs AI models to the same standard, regardless of what is formally in scope
iTuring’s Model Governance module applies one classification standard, one approval workflow, and one monitoring discipline across a bank’s full model portfolio, generative and agentic models included, without waiting for a rule that names them. The same Data Accelerator lineage that tracks a traditional model’s data and decisions tracks a generative model’s prompts, outputs, and downstream actions the same way, so the audit trail an examiner asks for exists whether or not the model in question sits inside SR 26-2’s current scope.
The same discipline supported the 116% improvement in collections recovery iTuring delivered for a leading NBFC in India, where governance ran as part of how every model operated. It never sat apart as a separate exercise applied only to the models a regulation happened to name.
An examiner asking about your generative or agentic AI models isn’t going to accept “it’s not in scope yet” as the answer. Book a 15-minute discovery call to see how iTuring governs every model your institution runs to one standard, regardless of what SR 26-2 formally covers today.
Sources
- “Supervisory Letter SR 26-2 on Revised Guidance on Model Risk Management,” Board of Governors of the Federal Reserve System, 17 April 2026. https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm
- iTuring.ai case study, “Improve Collections and Optimize Efforts.” https://ituring.ai/case-study/improve-collections-and-optimize-efforts/
- iTuring.ai, “Model Governance in Banking: Ownership, Approval, and Retirement.” https://ituring.ai/model-governance/
