US buyer guides / 02
What changed for banks when SR 11-7 was superseded?
In April 2026 the Federal Reserve, the OCC and the FDIC replaced SR 11-7 with SR 26-2, and the new guidance says generative and agentic AI models are outside its scope. A bank's own governance sets the controls for those.
The moment.
A model risk team maps a new AI assistant to SR 11-7 the way it always has. An examiner points out that SR 11-7 was superseded on 17 April 2026, and that the replacement does not cover this kind of model at all. The team now has to show its own rules, because the guidance will not do it for them.
If the guidance does not cover generative or agentic AI, what does our own governance say, and can we show the record of it being applied to this system?
What you would see.
SR 26-2 covers traditional and non-generative AI models. For generative and agentic AI, it says the bank's own governance decides. That moves the burden onto the buyer: the policy, the owner, the tests and the records are yours to define and yours to show. Source: federalreserve.gov/supervisionreg/srletters/SR2602.htm.
A good answer from the vendor is a record of what the system did on one transaction, so your governance has something to review. A bad answer is a mapping to SR 11-7 that no longer applies.
The record you would open
| model id | use | validation date | validator | open findings | next review |
|---|---|---|---|---|---|
| [model-id] | [approved use] | [YYYY-MM-DD] | [name or role] | [count] | [YYYY-MM-DD] |
Who is the guidance for, and what legal force does it have?
The agencies say SR 26-2 is expected to be most relevant to banking organizations with more than $30 billion in total assets.
It is supervisory guidance, not an enforceable standard. The agencies say they will not take enforcement action or issue criticism based on non-compliance with supervisory guidance.
Primary sources.
One thing to do.
Ask your model risk team for one sentence: what is our standard for generative and agentic AI now that SR 11-7 is gone? If the sentence does not exist, write it before the next purchase.
The words.
- SR letter:
- supervisory guidance from the US banking regulators.
- Superseded:
- replaced; the old letter no longer applies.
- Agentic AI:
- AI that acts, not only writes.
Free, no email gate.
Download The Agentic AI Procurement Handbook, second edition, version 4.0. The 87-page PDF is free with no email gate.
Download version 4.0See your own exposure scored.
The SecVantages AI security assessment takes ten to twenty minutes, needs no card and no call, and leaves you a scored report.
Start the free assessment