Get in touch
Get in touch
Strategy

The guidance that replaced SR 11-7 leaves out generative AI: what a bank should put in place now

Editorial · Reveneau · October 28, 2026

The guidance that replaced SR 11-7 leaves out generative AI: what a bank should put in place now

On 17 April 2026 the Federal Reserve issued SR 26-2, a supervision letter that "supersedes and replaces SR letter 11-7, Guidance on Model Risk Management (issued April 4, 2011) and SR letter 21-8." The Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) issued the same revised guidance that day. SR 11-7 had been the Fed's guidance on model risk since April 2011. Model risk is the chance of loss from decisions made on a model's output.

Footnote 3 of the new guidance says of AI: "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance." Generative AI produces new text, images or code, and agentic AI takes actions on its own to reach a goal. AI models that are neither generative nor agentic, such as ones that score or classify, remain in scope.

The OCC's bulletin says the agencies "plan to issue in the near future a request for information" on model risk and AI, "including generative AI and agentic AI." A search of the Federal Register on 26 October 2026 found no such request. A request for information is a step before guidance: the agencies ask questions and read the answers.

So a bank that uses a chatbot, an internal writing assistant or an AI agent today had no US model risk text written for those tools on 26 October 2026. Our view is that a bank should write its own short standard for them now, and build it from the parts the agencies have already published.

Outside the guidance, the bank is still responsible

For tools it does not cover, the guidance says "a banking organization's risk management and governance practices should guide the determination of appropriate governance and controls." The bank decides, and the bank answers for the decision.

The guidance also sets out its own weight. It "does not set forth enforceable standards or prescriptive requirements," and not following it "will not result in supervisory criticism." Its first footnote adds: "supervisory action may result for any violations of law or unsafe or unsound practices stemming from insufficient management of model risk." A chatbot's answers to customers fall under consumer protection law whatever model risk guidance covers them. The Consumer Financial Protection Bureau's (CFPB) 2023 report on chatbots in consumer finance says chatbots "must comply with all applicable federal consumer financial laws," like the processes they replace.

The OCC has described how banks use these tools. Its Semiannual Risk Perspective for spring 2026 says banks "are taking a measured approach to the adoption of generative AI (genAI) and agentic AI," mainly for productivity and customer experience, with use generally limited to specific cases, with controls and a person accountable in the process. A written standard is how a bank shows an examiner what those controls are.

The guide page on model risk rules and AI sets out everything the 2026 guidance replaced and how Canada and the UK compare. This post covers the standard itself.

1. Rate materiality first, because every other part depends on it

The 2026 guidance gives the test: "Model purpose, together with model exposure, determines model materiality." Materiality means how much harm a failure could cause. The Financial Stability Board's (FSB) sound practices of 15 October 2026 put the same step at the start, with an assessment of "the materiality and risks associated with AI use cases at inception and thereafter." And Federal Reserve Vice Chair for Supervision Michelle Bowman said on 7 July 2026 that "lower-risk uses of AI should receive a lighter supervisory and regulatory touch."

Take an invented bank with two generative AI tools. One drafts code for its developers. The other answers customers' questions about fees in the mobile app.

  • The code assistant's output is read, tested and reviewed by developers before any of it reaches a customer. Banks interviewed by the US Treasury in late 2023 described code-generating assistants as "low-risk, high-return use cases." It rates low.
  • The fee chatbot's answer goes straight to a customer, who may act on it. It rates high. An agent that can change an account would rate higher still.

Write the rating down with the reason, and size the tests and records for each tool to it.

2. Test before first use, with an eval in place of validation

The 2026 guidance says "Validation generally occurs prior to a model's first use," and that the "rigor of effective testing is commensurate with model complexity and materiality." For a scoring model, validation compares predictions with known results. A generative AI tool needs a different test, because it writes new text every time.

That test is an eval: a written, repeatable set of cases, each with the answer the bank expects, run against the tool before release. For the fee chatbot, the cases come from the bank's own fee schedule and policies, and the correct answer for each one is written down before the test runs. The set should include the errors the regulators have named. The National Institute of Standards and Technology (NIST) defines confabulation in its Generative AI Profile as "The production of confidently stated but erroneous or false content," and the FSB's 2024 report on AI names hallucinations as a new type of inaccuracy. The CFPB's report says "the ability for chatbots and scripts to recognize a dispute may be limited," so the set needs messages that raise a dispute without using the word.

Firms told the Treasury that generative AI was costly and hard to validate for uses that need a high level of assurance. A fixed set of cases with written answers is the part of that work a bank can control. The guide page on running an AI pilot inside a bank covers setting the pass criteria before the test.

3. Check results against real outcomes after release

Testing before release covers the cases the bank thought of. The 2026 guidance asks for two more checks. "Outcomes analysis compares model outputs to corresponding real-world outcomes," and "Ongoing model monitoring involves an evaluation of the extent to which a model is performing as expected."

For the fee chatbot, outcomes analysis means taking a sample of real conversations each month and scoring each answer against the fee schedule. Every wrong answer found in the sample should become a new case in the eval set, so the test before the next release covers it.

Monitoring also means rerunning the eval after every change. A hosted model can change version, and the bank's own team will edit the instructions. The guidance says "Using a model beyond its intended purpose introduces additional uncertainty and risk," so a tool moved to a new use, from fee questions to loan questions for example, needs a new rating and a new eval.

4. Give the review to people who can force a change

The 2026 guidance keeps the idea of "effective challenge," which it defines as "the critical analysis conducted by objective experts who evaluate model risk and effect appropriate changes throughout the model lifecycle." For a generative AI tool that means a reviewer outside the team that built or bought it, with the authority to stop a release.

A bank that buys the model faces a further limit. The guidance accepts that a bank "may not receive from the vendor the underlying code, data, or methodology," and says "Nevertheless, the principles of model risk management remain applicable." The 2023 interagency guidance on third-party relationships, which the agencies proposed to replace on 15 September 2026, says to "identify and document any limitations" of due diligence. For a model whose training data the vendor will not disclose, that record is what the bank can produce. The gap is common: in the Bank of England and Financial Conduct Authority (FCA) survey of 2024, 46% of responding firms said they had only "partial understanding" of the AI they use, and the survey links that to models from other companies.

The case for waiting

A careful bank has a real reason to wait. The agencies said a request for information is coming. If a bank builds controls now and the later guidance asks for something else, it builds them twice. Vice Chair Bowman also said the FSB practices "are not the only way to adopt and use AI responsibly," which a bank can read as room to take its time.

We still think the standard should be written now. Every part above comes from text the agencies have already published, and the OCC says "Many risks associated with AI are the same as those of models and tools that do not rely on AI." If new guidance arrives, a bank with a written standard has a document to compare it against, and its dated eval results show what each tool did. Canada's Office of the Superintendent of Financial Institutions (OSFI) made a point against waiting when it endorsed the FSB practices on 15 October 2026: institutions "face the risk of falling behind if they fail to adopt AI at a sufficient pace."

The guide on AI in banking covers the rest of the rules, and the page on what bank regulators have said about generative AI puts every statement in date order.

Reveneau is an AI software development consultancy with offices in San Francisco and Vancouver. Reveneau says AI writes all of its code and every change must pass an eval suite written from the specification, graded by Jev, TypeSafe AI's decision model, which Reveneau says runs that suite ten times faster than its previous grader. It says it takes responsibility for the whole project through production and after release.

Credit for this piece goes to the staff of the Federal Reserve, the OCC and the FDIC, who listed every document the new guidance replaced, and to the authors of the CFPB, Treasury, NIST and Bank of England reports quoted here.

The guidance tells a bank what it may leave out. The standard records what the bank chose to test.

Sources

Common questions

What should a bank's own standard for generative AI contain?

Our view is four parts, each taken from the 2026 model risk guidance: a materiality rating for every tool, a written test before first use, outcomes analysis and monitoring after release, and review by people independent of the team that built or bought the tool. Each part is scaled to the rating, so a low-rated internal tool gets a one-page record and a customer-facing tool gets a full one.

Can a US bank be criticised for how it manages a generative AI tool the 2026 guidance does not cover?

Yes. The 2026 guidance says that not following it does not by itself bring supervisory criticism, but it also says supervisory action may result from violations of law or unsafe or unsound practices. A generative AI tool that gives customers wrong answers or mishandles their data can still lead to action under existing law, whatever guidance covers it.

How should a bank rate the materiality of a generative AI tool?

Use the test the 2026 guidance gives for other models: purpose together with exposure determines materiality. Ask who reads the output, what decision or action follows from it, and how many customers or how much money it reaches. A tool whose answer goes straight to a customer, or whose action changes an account, rates higher than one whose output a trained employee checks first.

What replaces model validation for a generative AI assistant?

An eval, which is a written, repeatable test of the assistant's answers against cases the bank chooses, with the correct answer for each case taken from the bank's own policies. The 2026 guidance says validation generally occurs before a model's first use, so our view is that the eval runs and passes before release, and again after every change to the model or its instructions.

What cases should a bank's generative AI eval set include?

Start with the questions the tool will get most often, then add the cases where a wrong answer causes harm: fees, rates, eligibility, deadlines and disputes. The Consumer Financial Protection Bureau's 2023 chatbot report says chatbots may fail to recognise that a customer is raising a dispute, so include messages that raise one without using the word. Add cases built to catch confidently stated false content.

How often should a bank rerun its generative AI tests?

Rerun them before release, after every change to the model, its version or its written instructions, and on a fixed schedule set by the tool's materiality rating. A vendor can change or retire a hosted model, and the 2026 guidance says using a model beyond its intended purpose adds risk, so a new use also needs a new run.

Does a bank under $30 billion in assets need a written standard for generative AI?

The Office of the Comptroller of the Currency says the 2026 guidance is most relevant to banks over $30 billion in assets, with exceptions for smaller banks with heavy model use. Our view is that a smaller bank still needs a short written standard for each generative AI tool it uses, because supervisory action can follow from unsafe practices at a bank of any size.

Are agentic AI tools treated differently from generative AI chatbots under the 2026 guidance?

No. The guidance puts both outside its scope in the same footnote. The difference is in the materiality rating: the Bank of England's Financial Policy Committee describes agentic systems as ones that take autonomous action to reach goals using tools, so an agent that can act on an account rates higher than a chatbot that only answers.

Does a code assistant for a bank's developers need the same controls as a customer chatbot?

It needs the same four parts at a lower rating. A code assistant's output is read and tested by developers before it reaches a customer, so its record can be short. Banks interviewed by the US Treasury in late 2023 described code-generating assistants as low-risk uses, which fits a lighter set of controls.

Who should review a bank's generative AI tool before release?

People independent of the team that built or bought it, with the standing to force a change. The 2026 guidance calls this effective challenge and defines it as critical analysis by objective experts who evaluate model risk and effect appropriate changes. For a customer-facing tool, include someone who knows the consumer protection rules the answers must follow.

Read more on this topic

AI in banking: how a bank uses AI under the rules it answers to

Model risk rules and AI: what replaced SR 11-7 in 2026

You might also be interested in

Super Intelligence vs AI: the new federal name uses the 2020 definition of AI
StrategyOct 6, 2026

Super Intelligence vs AI: the new federal name uses the 2020 definition of AI

On 29 September 2026 the White House told federal agencies to write Super Intelligence and SI in place of AI. Section 3 of the order defines SI as the technologies already covered by the 2020 federal definition of AI.

What a buyer should do now that OpenAI has stopped reporting SWE-bench Verified
StrategyOct 4, 2026

What a buyer should do now that OpenAI has stopped reporting SWE-bench Verified

On 23 February 2026 OpenAI said it had stopped reporting SWE-bench Verified, and on 8 July 2026 it withdrew its recommendation of SWE-Bench Pro. This post gives OpenAI's figures with their limits, then shows how to choose a coding model on 100 of your own tasks.

The Mechanical Orchard story: how a company built on pair programming came to argue against code review
StrategySep 17, 2026

The Mechanical Orchard story: how a company built on pair programming came to argue against code review

Rob Mee built Pivotal Labs on pair programming and human review. The company he founded in 2022 now publishes an essay saying code must not be reviewed by humans, and the public record shows how it got there.

Start a project