AI model risk management in banking: what reviewers expect
· 6 min read · By YLinkTech
AI model risk management in banking means putting AI systems through the bank’s model risk framework: an inventory entry, testing and validation sized to the risk, ongoing monitoring and clear ownership. In the United States, the interagency guidance was revised in April 2026 and replaced SR 11-7. It applies to traditional models and to AI models that are not generative or agentic. Generative and agentic AI sit outside its scope, so banks govern them under their wider risk practices.
This article summarizes public guidance at a general level. It is not regulatory or legal advice. Confirm how the guidance applies to your institution with your own risk and compliance teams.
What changed in US model risk guidance in 2026
On April 17, 2026, the Office of the Comptroller of the Currency, the Federal Reserve Board and the Federal Deposit Insurance Corporation issued revised guidance on model risk management. The Federal Reserve published it as SR 26-2, which states that it supersedes SR 11-7 from 2011. The OCC published it as Bulletin 2026-13, which rescinds Bulletin 2011-12 and the OCC’s model risk handbook booklet.
Several points in the agencies’ text matter to anyone building AI for a bank:
- Risk-based and tailored. Practices should match the bank’s model risk profile and the size and complexity of its operations. What suits one bank may not suit another.
- Size. The agencies expect the guidance to be most relevant to banking organizations with more than $30 billion in total assets. It may still be relevant to smaller ones with significant model risk exposure.
- What a model is. A model is a complex quantitative method that applies statistical, economic or financial theories to turn input data into quantitative estimates. Simple arithmetic and deterministic rule-based processes are excluded.
- AI scope. The principles apply to traditional statistical models and to non-generative, non-agentic AI models. Generative and agentic AI are described as novel and rapidly evolving and are not in scope. The guidance text adds that a bank’s own risk management and governance practices should guide the controls for anything not covered.
- Status. The guidance says it does not set enforceable standards or prescriptive requirements. It also notes that supervisory action may still follow from violations of law or unsafe or unsound practices linked to poor model risk management.
The OCC bulletin also says the agencies plan to issue a request for information on model risk management and banks’ use of AI, including generative and agentic AI. Expect this area to keep moving, and check the regulators’ pages for the current position. Banks outside the United States work under their own supervisors’ rules.
What AI model risk management in banking looks like in practice
The regulators set principles. Your bank’s own model risk policy turns them into requirements, and it is the policy your project will be reviewed against. It may be broader than the interagency guidance. Ask for it early.
The guidance describes the model lifecycle in a way that maps directly to what a model risk team will ask an AI project to produce.
| Area | What the guidance describes | What to prepare for an AI model |
|---|---|---|
| Purpose and use | Development starts with a clear statement of purpose. Using a model beyond its intended purpose adds risk. | A written intended use, known limitations and uses that are out of bounds |
| Development and testing | Testing can include out-of-sample and out-of-time tests, comparison of alternative methods and a critical look at data quality. | Test results, data sources and lineage, and the alternatives you considered |
| Validation | Validation assesses conceptual soundness and compares outputs with real outcomes. For some models, interpretability measures or benchmarking may be more practical than reviewing theory. | Explainability evidence, a benchmark against a simpler model and back-testing |
| Monitoring | Ongoing monitoring checks whether the model still performs as products, data and markets change. | Performance and drift metrics, thresholds and the action taken when one is crossed |
| Governance | Clear roles, a model inventory and adequate documentation. | A named owner, an inventory entry and a record of changes |
| Vendor models | The principles still apply when code or data is proprietary, including validation and outcome analysis. | Vendor documentation plus your own testing on your own data |
The guidance says validation generally happens before a model’s first use. Where a model must be used before validation is complete, it describes paying closer attention to the model’s limitations, telling stakeholders about them and adding controls such as limits on use.
Materiality and effective challenge
Two ideas shape how much work a review involves.
The first is materiality. The guidance describes it as a combination of exposure, meaning how much the output matters to business decisions, and purpose. Models that help meet regulatory requirements or manage financial risk are generally treated as higher risk. For models a bank deems immaterial, risk management may be limited to identifying them and watching for conditions that would make them material. Higher materiality calls for more rigorous oversight. Propose a tier for your model early, with reasons, so the review is sized correctly.
The second is effective challenge: critical analysis by objective experts who have the expertise, the independence and the standing to get changes made. For an engineering team this means the people who review your model must not be the people who built it, and their findings need a tracked response.
Governing generative and agentic AI
Being out of scope of the model risk guidance does not mean being ungoverned. The agencies point back to the bank’s own risk management and governance. Many of the same habits transfer well, and the following are practical suggestions, not regulatory requirements:
- List generative AI systems and agents in an inventory, with an owner and a risk rating
- Build an evaluation suite that tests accuracy, harmful output and prompt injection before release and after every model or prompt change
- Give each agent an identity, limited permissions and spending limits
- Require human approval for actions that carry customer or financial risk
- Log inputs, outputs and tool calls so decisions can be reconstructed
- Treat the model provider as a third party and review it as one
Whether a workflow needs an agent at all is worth settling first. A rule-based automation is easier to explain, and deterministic rule-based processes are excluded from the guidance’s definition of a model. The trade-offs are covered in AI agents vs workflow automation.
How to prepare an AI project for review
- Read the bank’s model risk policy and ask how it classifies your system.
- Write the purpose statement and intended use before you train anything.
- Record data sources, lineage and quality checks as you go.
- Keep a simple benchmark model to compare against.
- Agree monitoring metrics and thresholds with the model owner before launch.
- Involve the validation team at design time, not the week before release.
Legacy platforms often make the data lineage step hard, which is one reason AI programs and core system modernization tend to be planned together.
How YLinkTech helps
We build AI systems for financial services and insurance clients through our AI & Data practice. Our responsible AI and governance work covers AI inventories and risk classification, evaluation and red-team testing, guardrails, audit trails and model documentation. We prepare that material in the format your model risk team asks for, and your risk and compliance teams remain the decision makers. To discuss a project that is heading for review, contact us.
Frequently asked questions
Is SR 11-7 still in effect?
No. On April 17, 2026, the Federal Reserve, the OCC and the FDIC issued revised guidance on model risk management. The Federal Reserve's SR 26-2 states that it supersedes and replaces SR 11-7. Check the regulators' websites for the current text and confirm how it applies to your institution with your compliance team.
Does US model risk guidance cover generative AI?
The 2026 interagency guidance says generative and agentic AI models are not within its scope. Its principles apply to traditional models and to non-generative, non-agentic AI models. The agencies add that a bank's own risk management and governance practices should guide controls for tools the guidance does not cover.
What do model risk teams ask for first on an AI project?
Usually a clear statement of what the model is for and how it will be used, followed by evidence of testing, data sources and quality, a monitoring plan and a named owner. Each bank's policy sets its own requirements, so ask your model risk team for its documentation standards at the start.
Sources
- Federal Reserve Board: SR 26-2, Revised Guidance on Model Risk Management (April 17, 2026)
- Federal Reserve Board, FDIC and OCC: Supervisory Guidance on Model Risk Management (SR 26-2 attachment)
- Office of the Comptroller of the Currency: Bulletin 2026-13, Model Risk Management: Revised Guidance
This article is general information, not professional advice. See our Disclaimer.