Mostly not, under the SR 26-2 model definition. On 17 April 2026 the OCC, the Federal Reserve and the FDIC issued revised model risk guidance (OCC Bulletin 2026-13, Fed SR 26-2, FDIC FIL-15-2026); SR 26-2 "supersedes and replaces SR letter 11-7", and the OCC rescinded its 2011 counterpart, Bulletin 2011-12. It defines a model as "a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates", and expressly excludes "simple arithmetic calculations, such as those found within spreadsheets, as well as deterministic rule-based processes and software where there are no statistical, economic, or financial theories underpinning their design or use." Generative and agentic AI models "are not within the scope of this guidance" at all. A spreading tool such as Botminds' Commercial Financial Spreading therefore divides into arithmetic and rules, which the definition excludes; AI extraction and drafting, which the guidance leaves out of scope; and judgement, which stays with people. Each needs a different control.
What changed on 17 April 2026
SR 26-2
supersedes and replaces SR 11-7; the OCC rescinded its counterpart, Bulletin 2011-12
2 exclusions
simple spreadsheet arithmetic and deterministic rule-based processes are not models under the definition
Out of scope
generative and agentic AI models, “novel and rapidly evolving”
$30B+
banks for which the guidance is expected to be most relevant
What the 2026 guidance calls a model, and what it excludes
The definition turns on theory and estimation. A model "applies statistical, economic, or financial theories to process input data into quantitative estimates". A probability-of-default model, a pricing model or a stress-loss model does that. Adding up a column of keyed figures does not, and the guidance says so twice: simple arithmetic "such as those found within spreadsheets" and "deterministic rule-based processes and software where there are no statistical, economic, or financial theories underpinning their design or use" are both excluded (OCC Bulletin 2026-13).
One sentence pulls the other way. The OCC's 2026 lending booklet notes that "Banks also use models for loan pricing, financial analysis, stress testing, and portfolio monitoring", and that models "used for credit underwriting and decisioning should be subject to sound model risk management" (OCC). "Financial analysis" there covers projection and scoring tools; whether a particular spreading feature is one of them depends on what it does, which is the reason to classify each part separately.
SR 11-7 vs SR 26-2: what changed, and what it means for spreading
Four things changed that matter to a spreading tool: the status of the old letter, the definition, the scope and the tone. SR 26-2 "supersedes and replaces SR letter 11-7" and also supersedes SR 21-8, the 2021 statement on models in anti-money-laundering systems (SR 26-2). The OCC went further on its side and rescinded its "Model Risk Management" handbook booklet, Bulletin 1997-24 on credit scoring models, Bulletin 2011-12 and Bulletin 2021-19 (OCC Bulletin 2026-13).
The definition now carries explicit exclusions for spreadsheet arithmetic and deterministic rules, which is where most of a spread lives. The scope now carves out generative and agentic AI, which is where the newest part of a spreading tool lives. And the guidance describes itself as "a risk-based approach to model risk management", "tailored to a banking organization's model risk profile and the size and complexity of its operations", and not as a set of enforceable rules. It also says it "will be most useful for models supporting a banking organization's significant business lines".
For spreading, the combined effect is that very little of the tool is a model in the 2026 sense, and the part most likely to worry a risk committee, the AI reading the documents, is explicitly left for later. The agencies said they plan a request for information on AI, including generative and agentic AI. Until it appears, the evidence a bank keeps for its AI steps has to come from its own framework, and the sections below suggest what that evidence is.
Does SR 26-2 apply to community banks?
It applies, but lightly. The Federal Reserve says the letter "is expected to be most relevant to banking organizations with over $30 billion in total assets regulated by the Federal Reserve" (SR 26-2), and the OCC bulletin repeats its 2025 clarification that its guidance "does not, and should not be interpreted to, require community banks to perform annual model validation" (OCC Bulletin 2026-13). Community and regional banks do most owner-managed commercial lending, so for most banks that spread K-1s and Schedule E by the hundred, the model guidance is now the lightest of the texts that apply.
Light is not absent. A community bank that buys a spreading tool still owes third-party due diligence, still has to meet the safety-and-soundness standards for loan documentation, and is still examined on whether its financial analysis supports its credit decisions. What changes is the vocabulary: the bank does not need to call its spreading tool a model in order to test it, and it should not skip the test because the tool is not one.
A decision tree for each part of a spreading tool
Apply the definition to each component, not to the product. One spreading tool can contain all three cases.
Which governance applies to a part of a spreading tool
Question 1
Does the part apply statistical, economic or financial theory to produce an estimate?
No
Not a model
Arithmetic and deterministic rules: footing, tie-outs, mapping rules, coverage and ratios. Control with tests and change management.
Yes
Question 2
Is it a generative or agentic AI model?
Yes
Outside the 2026 guidance
Reading documents, drafting exceptions. Govern under third-party guidance, safety-and-soundness standards and the bank’s own AI policy.
No
A model
Projections, scores, ratings. Model risk management in proportion to use.
Commercial Financial Spreading, step by step through the definition
Taken step by step, most of a spread sits on the "not a model" side, one part is AI that the guidance leaves out, and the decisions are people's. The table classifies each step of the solution as it runs on a borrower package.
Each step of the spread, classified under the 2026 definition
| Step | What it does | Under the 2026 guidance | Control that fits |
|---|---|---|---|
| Sorting and reading documents | Agents identify documents and read figures from returns and statements | Agentic AI: outside the guidance’s scope | Every figure cites its page; seeded-error testing; third-party due diligence |
| Mapping to the chart of accounts | Lines mapped to the bank’s template; learned rules with an owner and a scope | Deterministic rules: excluded | Rules visible with their author and date; versioned template |
| Footing and tie-outs | Totals, Schedule L to the balance sheet, M-1 to book income, within a tolerance | Arithmetic: excluded | The tolerance is a versioned setting |
| Global cash flow and coverage | Sums and a division under the bank’s chosen method | Arithmetic: excluded | Method is a policy setting; each line pinned to its page |
| Ratios, trends and peer medians | Ratios by year and trailing twelve months against a peer median | Arithmetic and description: excluded | Swing thresholds from settings; peer set named |
| Stress calculator | Recomputes coverage as margin or revenue is moved | Arithmetic sensitivity, no estimation theory | Inputs and results shown; no automatic decision |
| Writing exceptions | Drafts each failed check and the request that would clear it | Generative text: outside the guidance’s scope | Never sent without the analyst; every figure in it cited |
| Decisions and signatures | Confirm, re-map, accept, sign, co-sign | People | Signing limits, reasons for overrides, two signatures above the limit |
Out of scope of the model guidance does not mean out of scope of supervision. It means the controls come from somewhere else.
Outside the guidance is not outside supervision
The AI parts of a spreading tool are still governed, by older and more general texts. The safety-and-soundness standards require loan documentation practices that "Enable the institution to make an informed lending decision and to assess risk" and "Identify the purpose of a loan and the source of repayment" (12 CFR 30, Appendix A); a spread whose figures cannot be traced fails that whether or not it is a model. The 2023 third-party guidance says "the use of third parties does not diminish or remove banking organizations' responsibilities" (88 FR 37920). And the OCC describes the way banks are using generative and agentic AI as "limited to specific use cases with guardrails and human-in-the-loop accountability to manage risk" (OCC, Spring 2026).
In practice, the AI parts need the evidence a model would need, organised differently. The question is not "is the model conceptually sound?" but "can every figure the AI produced be checked against its source, and has anyone measured how often the AI misses what matters?". The first is a design property: in the solution, each of the 1,186 figures on the sample spread carries its document, page and line. The second is a test: planting twelve kinds of error sets one out.
Model risk controls and the controls an AI spreading step needs
Model under the 2026 guidance: Is the theory sound and the estimate fit for its use?
AI extraction and drafting in a spread: Is each figure the one on its page, and is every material problem surfaced?
Model under the 2026 guidance: Development documentation, validation, outcomes analysis.
AI extraction and drafting in a spread: A citation for every figure; seeded-error catch rates by type; false-alarm rates.
Model under the 2026 guidance: Re-validation when the model changes.
AI extraction and drafting in a spread: Re-test when the tool, template or settings change; versioned settings.
Model under the 2026 guidance: Effective challenge of the model.
AI extraction and drafting in a spread: Review of every flagged line; signature; overrides with reasons.
Model under the 2026 guidance: Vendor models in the inventory.
AI extraction and drafting in a spread: Third-party due diligence; the bank keeps responsibility.
The parts that are rules, shown as settings with an owner
Learned mapping rules: deterministic, but with an author
One feature tests the line between rule and model: rules the spread learns from an analyst. When the sample analyst re-maps rent paid to the owners' property company from third-party occupancy to affiliate rent, the re-map becomes a rule for that borrower and its related entities, with her name and the date on it, and it maps the same line on the next annual review before anyone opens it.
That is a deterministic rule written by a named person, not an estimate from a theory, and it sits on the excluded side of the definition. Its control is the same as any policy rule: it is visible, scoped, attributable and reversible. A second-line reviewer can list every learned rule on a borrower, see who made it and when, and see which later spreads it applied to.
A learned rule, with its author and its scope
What a model risk or second-line team should ask of a spreading tool
- Classify each component, not the product
Arithmetic, rules, AI extraction, AI drafting, any genuine model, and the human decisions.
- Ask for the citation on every figure
Without it, AI extraction cannot be checked except by re-keying.
- Ask for catch rates by error type
From a seeded-error test the bank designs or witnesses, with the number planted.
- Check what the AI may never do
Sign, send to a borrower, plug a statement, change a threshold.
- Check settings are versioned
And that a change applies only to spreads started after it.
- Record the classification
In the model inventory or the AI register, with the reason, so an examiner can follow it.
The classification will move as the agencies act on their promised request for information. The controls that matter, a page for every figure, a measured catch rate, a person's signature, do not depend on which side of the definition a component falls. The run, step by step shows those controls in sequence; the Commercial Financial Spreading page shows the screens.
Questions people ask
Is SR 11-7 still in force?
No. SR 26-2 superseded and replaced it on 17 April 2026, and on the same day the OCC rescinded its own 2011 guidance, Bulletin 2011-12; the FDIC issued the revised guidance as FIL-15-2026. References to SR 11-7 in a bank's model risk policy now point to a letter that has been replaced and should be updated.
Is SR 26-2 enforceable?
Not as a rule. Beyond disclaiming enforceable standards, the bulletin adds that "non-compliance with this guidance will not result in supervisory criticism" (OCC). Examiners can still criticise unsafe practices on other grounds, such as weak financial analysis or third-party oversight.
Does a vendor's spreading tool need validation?
Only the parts that are models, and the 2026 guidance has its own discussion of "vendor and other third-party products" for those. For the rest, the third-party guidance applies: the bank keeps responsibility for the activity, so it needs its own evidence that the tool works on its borrowers, such as a seeded-error test it designs or witnesses.
Does a spreadsheet template need model validation?
Under the 2026 definition, the arithmetic in a spreadsheet is excluded from "model". The template still needs ordinary controls: locked formulas, versioning, and a check that the right figures went into it.
Is AI-extracted data a model output?
If the extractor is a generative or agentic AI model, the 2026 guidance leaves it out of scope. The bank still needs evidence that the extracted figures are right, which page citations and seeded-error testing provide.