Model risk rules and AI: what replaced SR 11-7 in 2026

On 17 April 2026 the Board of Governors of the Federal Reserve System (the Fed) issued SR 26-2, a supervision and regulation letter, with revised guidance on model risk management. The letter says it "supersedes and replaces SR letter 11-7, Guidance on Model Risk Management (issued April 4, 2011) and SR letter 21-8" [1]. The Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) issued the same guidance the same day [3][5].

The 2026 guidance defines model risk as "the potential for adverse financial consequences associated with models, which may result from decisions made based on model output" [2]. SR 11-7 was issued on 4 April 2011 and stayed in place until April 2026. This page sets out what the agencies replaced, what the 2026 text says about AI, and how the Canadian and UK rules compare. It is part of the guide on AI in banking. Every status here is as of 26 October 2026.

What was replaced on 17 April 2026

The new guidance came with a list of older documents that no longer apply. The OCC said it "is rescinding prior model risk management issuances, including OCC Bulletin 2011-12" [4], and the FDIC said it "is rescinding existing model risk management guidance (FIL-22-2017 and FIL-27-2021)" [5]. To rescind a document is to withdraw it.

Document	What it was	Status as of 26 October 2026
Fed SR 11-7 (April 2011)	Model risk guidance	Superseded by SR 26-2 on 17 April 2026 [1]
Fed SR 21-8 (April 2021)	Model risk for systems supporting Bank Secrecy Act and anti-money laundering compliance	Superseded by SR 26-2 on 17 April 2026 [1]
OCC Bulletin 2011-12	The OCC's copy of the 2011 guidance	Rescinded on 17 April 2026 [3][4]
OCC Bulletin 2021-19	The OCC's copy of the 2021 statement	Rescinded on 17 April 2026 [3]
OCC Bulletin 1997-24	Examination guidance on credit scoring models	Rescinded on 17 April 2026 [3]
Comptroller's Handbook, "Model Risk Management" booklet	The OCC examiners' booklet on model risk	Rescinded on 17 April 2026 [4]
FDIC FIL-22-2017 and FIL-27-2021	The FDIC's existing model risk guidance	Rescinded on 17 April 2026 [5]
Revised interagency guidance (SR 26-2, OCC Bulletin 2026-13, FDIC FIL-15-2026)	The new model risk guidance	In effect since 17 April 2026; does not bind banks [2]

A bank whose model policy still cites SR 11-7 or Bulletin 2011-12 is citing documents that no longer apply, and should update those references.

What counts as a model now

The 2026 guidance says that "the term 'model' refers to a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates" [2]. The definition then "excludes simple arithmetic calculations, such as those found within spreadsheets, as well as deterministic rule-based processes and software" [2]. A deterministic process is one that gives the same output every time for the same input, such as a fixed rule that declines any application below a set income.

The definition requires the method to be complex, and it lists what is excluded. When a bank applies it, some tools may leave the model inventory, and the bank should record which tools left and why. The UK's definition does not require complexity and names mathematical theories: the Prudential Regulation Authority (PRA) defines a model as "a quantitative method that applies statistical, economic, financial, or mathematical theories, techniques, and assumptions to process input data into output" [8]. Canada's Office of the Superintendent of Financial Institutions (OSFI) names AI directly, as shown later on this page.

Where AI sits in the 2026 guidance

The guidance splits AI into two groups. On one side, it says that "the principles described in this guidance apply to traditional statistical and quantitative models and non-generative, non-agentic AI models" [2]. A machine learning model that scores fraud risk or predicts loan default is in that group. On the other side, footnote 3 says: "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance" [2]. Generative AI is AI that writes text, images or code, such as a chatbot built on a large language model, a model trained on large amounts of text to write text. Agentic AI is AI that takes actions on its own, such as calling other software, to reach a goal.

For those tools, the guidance gives one instruction: "a banking organization's risk management and governance practices should guide the determination of appropriate governance and controls for any tools, processes, or systems not covered in this document" [2]. So a bank decides the controls for its generative AI tools itself, and writes them into its own policies.

The OCC's announcement adds that "the agencies plan to issue in the near future a request for information that addresses model risk management generally and considers, in particular, banks' use of AI, including generative AI and agentic AI and AI-based models" [3]. A request for information (RFI) is a public request by an agency for comments and information. This guide found no such request in the Federal Register as of 26 October 2026.

Guidance, with no enforceable standards

On its legal weight, the 2026 text says: "This guidance does not set forth enforceable standards or prescriptive requirements; accordingly, non-compliance with this guidance will not result in supervisory criticism against a banking organization" [2]. Footnote 1 adds: "However, supervisory action may result for any violations of law or unsafe or unsound practices stemming from insufficient management of model risk" [2].

Read together, the two sentences mean that departing from the guidance is not by itself a ground for criticism, while a violation of law or an unsafe or unsound practice that comes from poor management of model risk can still lead to supervisory action. A bank should confirm with its examiners and its own counsel how they will read this for its charter and its size.

The OCC says the guidance "is expected to be most relevant to banking organizations with over $30 billion in total assets" [3]. It names an exception for smaller banks "that have significant exposure to model risk because of the prevalence and complexity of their models" [3]. Before the revision, in Bulletin 2025-26 of 6 October 2025, the OCC said its guidance "does not, and should not be interpreted to, require community banks to perform annual model validation" [6]. That bulletin was not among the documents rescinded in April 2026, and Bulletin 2026-13 cites it in a footnote [3].

What the 2026 guidance asks for

The OCC summarises the structure in three parts: "(1) model development and model use, including model testing; (2) model validation and monitoring, including validating conceptual soundness and outcomes analyses; and (3) governance and controls" [3]. Validation checks whether a model performs as expected, including how reliable it is and where its limits are [2]. Conceptual soundness means the model's design and logic fit its purpose.

Four ideas in the text apply to an AI model:

• Effective challenge. The guidance defines it as "the critical analysis conducted by objective experts who evaluate model risk and effect appropriate changes throughout the model lifecycle" [2]. The people who do this need the expertise, enough independence to stay objective, and the standing in the organisation to bring about a change [2].
• Materiality. "Model purpose, together with model exposure, determines model materiality" [2]. Materiality means how much harm a model's failure could cause. A model that sets credit limits for many customers needs more scrutiny than one that sorts internal email.
• Inventory. The guidance calls it "common industry practice" to keep a full set of information on models in development or in use [2]. An inventory is the list of every model, its owner, its purpose and its validation status.
• Vendor models. Banks "may not receive from the vendor the underlying code, data, or methodology", and "Nevertheless, the principles of model risk management remain applicable" [2]. The page AI vendor risk for banks covers how to get what validation needs from a vendor.

Canada and the UK compare

OSFI published Guideline E-23, Model Risk Management (2027), on 11 September 2025, and it takes effect on 1 May 2027 [7]. It "applies to all federally regulated financial institutions" [7]. Its definition of a model is "An application of theoretical, empirical, judgmental assumptions or statistical techniques, including AI/ML methods, which processes input data to generate results" [7]. AI/ML means AI and machine learning. Its inventory "contains all models whose inherent risk is determined to be non-negligible to the institution" [7], and it lists the model lifecycle as design, review, deployment, monitoring and decommission [7].

The PRA's supervisory statement SS1/23 applies to UK-incorporated banks, building societies and PRA-designated investment firms "with internal model approval to calculate regulatory capital requirements" [8]. It took effect on 17 May 2024 [8]. The PRA's page lists the current version as "Published 23 April 2026. Effective from 23 April 2026" [9], and the PDF cover is dated 16 April 2026 [8]. It covers "the use of artificial intelligence in modelling techniques such as machine learning" [9], and it expects firms to update a self-assessment "at least annually" [8].

Question	US 2026 guidance	Canada E-23	UK SS1/23
Status as of 26 October 2026	In effect since 17 April 2026 [2]	Published; takes effect 1 May 2027 [7]	In effect since 17 May 2024; version of April 2026 [9]
Who it applies to	Most relevant to banks over $30 billion in assets, and to smaller banks with large model exposure [3]	All federally regulated financial institutions [7]	Banks, building societies and PRA-designated firms with internal model approval [8]
AI models	Non-generative, non-agentic AI in scope; generative and agentic AI out of scope [2]	Definition includes AI and machine learning methods [7]	Covers the risks of AI used in modelling techniques such as machine learning [9]
Legal weight	No enforceable standards [2]	Guideline	Supervisory statement

A bank with operations in more than one of these countries should check each model against the rules of each country where it is used. That is a question for its own counsel and its supervisors in each country.

What a bank should do about generative AI now

The OCC says it "is also actively reviewing supervisory expectations, guidance, and regulations to ensure that innovative opportunities are available to all OCC-supervised banks, rather than only a few, that wish to take advantage of AI" [10]. Until the promised request for information becomes guidance, the controls for generative AI are the bank's own.

Reveneau's view is that a bank should keep its generative AI tools in the same inventory as its other models, even though the US guidance leaves them out. Each entry needs an owner, a written purpose, a materiality rating, and a record of how the tool was tested before use and how it is checked after. The test for a generative AI tool is an eval: a written, repeatable test of its answers against cases the bank chooses, run before release and again after any change to the model or its instructions. Dated eval results give an examiner a record to read. The guide on LLM evals explains the method, and the page on evals as compliance evidence explains how to keep the results.

Where Reveneau fits

Reveneau is an AI software development consultancy with offices in San Francisco and Vancouver. Reveneau says AI writes all of its code, and every change must pass an eval suite written from the specification, the written description of what the software must do. Reveneau says Jev, TypeSafe AI's decision model, grades that suite, and that the suite runs ten times faster than it did with its previous grader. It says it takes responsibility for the whole project through production and after release. For a bank, a useful question to put to any builder is what its test record shows. To discuss a project, see Reveneau's services or contact Reveneau. The next page in this guide covers the EU AI Act for banks.