For fifteen years SR 11-7 set the bar for model risk in US banks. Its replacement keeps the principles — and puts generative and agentic AI explicitly outside its scope.
This guide explains what SR 11-7 asked of banks, what changed when the Federal Reserve, OCC and FDIC replaced it with SR 26-2 on 17 April 2026, whether a large language model counts as a model, and how its principles — validation, effective challenge, monitoring, vendor oversight — carry over to LLM applications and agents now that no US model risk letter covers them directly.
Updated · 7 sources
SR 11-7 no longer applies to anything: on 17 April 2026 the Federal Reserve, FDIC and OCC superseded it with SR 26-2 (OCC Bulletin 2026-13). The new guidance states that generative AI and agentic AI models are not within its scope, while saying a bank’s risk management and governance practices should still guide the controls for tools it does not cover. In practice, banks govern LLMs and agents with SR 11-7’s principles — validation, effective challenge, ongoing monitoring, vendor oversight — adapted to models whose output is language and action.
SR 11-7 defined a model as a quantitative method that applies statistical, economic, financial or mathematical theories to turn input data into quantitative estimates — including methods with qualitative or expert-judgment inputs, provided the output is quantitative. Model risk came from two sources: a model with fundamental errors, and a sound model used incorrectly.
Effective challenge. The guiding principle: critical analysis by objective, informed parties who can identify a model’s limitations and get changes made. SR 11-7 said it depends on incentives, competence and influence.
SR 26-2 keeps the vocabulary — validation, monitoring, effective challenge, inventory — but makes the whole framework risk-based and scaled to materiality, narrows what counts as a model, and says outright what is outside it.
Supervisory guidance from the Federal Reserve, issued by the OCC as Bulletin 2011-12. Detailed expectations across the model lifecycle.
Revised guidance from the Federal Reserve, FDIC and OCC (OCC Bulletin 2026-13), issued 17 April 2026.
Under SR 26-2 the answer is set by footnote: generative and agentic AI models are novel and rapidly evolving, so they are not within the guidance’s scope. That does not leave them ungoverned. The same footnote says a bank’s risk management and governance practices should determine the controls for tools the guidance does not cover — and the principles still apply to non-generative AI.
What does the generative AI application produce? (Our reading — no agency has ruled on these cases.)
Watch for the request for information. When it issued the revised guidance, the OCC said the agencies plan to issue a request for information on model risk management with particular attention to banks’ use of AI, including generative and agentic AI. Expect specific supervisory views to follow it.
Each SR 11-7 idea has a working equivalent for a language model or an agent. What changes is the evidence: there is rarely one right answer to compare against, the model often belongs to a vendor, and the prompt, retrieval and tools are part of what is being validated.
| Principle | Traditional credit model | LLM application or agent |
|---|---|---|
| Conceptual soundness | Theory, variable selection, data and assumptions documented | Provider documentation, instructions, retrieval design, tool list and their limits documented |
| Developmental testing | Out-of-sample and out-of-time tests | Golden datasets of inputs with checked answers; attack tests such as prompt injection |
| Outcomes analysis | Back-testing against defaults | Outputs compared with reviewer decisions and downstream outcomes |
| Ongoing monitoring | Population stability, override rates | Score drift, reviewer edit rates, failed tool calls, complaints |
| Effective challenge | Independent validation team | Reviewers who did not build it, with the authority to block release |
| Vendor models | Developmental evidence from the vendor | Due diligence, contract terms on version changes and data use, own testing |
| Change control | Re-validate on redevelopment | Re-test on a new model version, prompt, retrieval source or tool |
| Limits on use | Overlays and conservative adjustments | Human approval on material actions; a way to disengage the system |
These are the properties that make a 2011-style validation report hard to write for an LLM application — and the reason the agencies set generative AI aside for separate study.
The same input can produce different text. Tests need repeated runs and pass rates, not one expected value.
A summary or a reply can be good in many ways. Scoring needs rubrics, reviewers or model judges that are themselves checked.
Weights and training data stay with the provider, and the provider updates the model. Pin versions and re-test on change.
Instructions, retrieved documents and tools shape behaviour as much as the model does. Validate the assembled application.
NIST calls it confabulation: confidently stated but false content. Sources shown with outputs let a reviewer check.
An agent acts. Limits on which tools it may use, approvals before material actions and a tested shutdown matter more than a better score.
Until the agencies publish more, the sound course is to keep generative AI and agents inside the same discipline that governed models — inventory, materiality, independent challenge, monitoring — and add the controls their new failure modes need.
Model risk management for generative AI needs tests that run on every change and a verdict recorded where reviewers will see it. On Botminds, those controls are part of the platform the agents run on; your model-risk function sets the thresholds and makes the calls.
See the evaluation gates and change control in AI governance on Botminds, and the Academy lesson on crew and evaluations.
No. SR 11-7 was superseded on 17 April 2026 by SR 26-2, revised model risk management guidance issued jointly by the Federal Reserve, FDIC and OCC. The OCC rescinded the matching Bulletin 2011-12 through Bulletin 2026-13.
The Federal Reserve’s supervision letter of 17 April 2026 that issued revised interagency guidance on model risk management. It is risk-based, scales practices to model materiality, is expected to be most relevant to banks above $30 billion in total assets, and does not set enforceable standards.
No. A footnote states that generative AI and agentic AI models are not within its scope because they are novel and rapidly evolving. It adds that a bank’s risk management and governance practices should guide controls for tools the guidance does not cover.
Evaluation of conceptual soundness, including developmental evidence; ongoing monitoring, including process verification and benchmarking; and outcomes analysis, including back-testing.
Critical analysis by objective, informed parties who can identify a model’s limitations and get changes made. SR 11-7 tied it to incentives, competence and influence; SR 26-2 keeps the term and asks for expertise, independence and standing.
Validate the assembled application, not only the model: test it on golden datasets with checked answers, measure pass rates over repeated runs, run attack tests, compare outputs with reviewer decisions, and re-test whenever the model version, instructions, sources or tools change.
The OCC’s 2011 issuance of the same supervisory guidance on model risk management as SR 11-7. It was rescinded on 17 April 2026 by OCC Bulletin 2026-13.
With evaluation gates on every agent publish against a pinned baseline, judges you choose, drift and calibration monitoring, versioned instructions with rollback and freeze, approvals on chosen tools and a verifiable audit trail — evidence your validators can review.
Bring one process and its documents. We’ll show you the agents, the controls and the record, running on your data.