SR 11-7 explained: the Fed's model risk guidance, replaced in 2026, and the AI its successor leaves out

SR 11-7 no longer applies to AI and machine learning models, or to any model: on 2026-04-17 the Federal Reserve, the FDIC and the OCC issued SR 26-2, which “supersedes and replaces” the 2011 letter.¹ By its own words the replacement applies to “traditional statistical and quantitative models and non-generative, non-agentic AI models”, and it puts generative and agentic AI models outside its scope.²

That makes the question most readers bring to SR 11-7 a question about SR 26-2. The 2011 letter has also left the Fed’s website: its page of 2011 supervision letters, read on 2026-11-11, runs from SR 11-15 down to SR 11-1 without an SR 11-7 entry.³ What follows is the new guidance in its own words, section by section, and what bank 10-Ks say about model risk and AI.

What SR 11-7 was, and what replaced it

SR 26-2’s cover letter names its predecessor exactly: SR letter 11-7, “Guidance on Model Risk Management,” issued April 4, 2011.¹ It also replaces SR letter 21-8 of April 9, 2021, the interagency statement on model risk management for bank systems supporting Bank Secrecy Act and anti-money-laundering compliance.¹ The letter is signed by Randall D. Guynn, Director of the Division of Supervision and Regulation, and says the revised guidance “reflects supervisory experience and industry feedback accumulated over the past fifteen years, as well as significant advancements in modeling practices.”¹

The change of tone is in two sentences. The cover letter says the agencies want “to emphasize a risk-based approach to model risk management that is tailored to a banking organization's model risk profile and the size and complexity of its operations.”¹ And the attachment says the guidance “does not set forth enforceable standards or prescriptive requirements; accordingly, non-compliance with this guidance will not result in supervisory criticism against a banking organization.”² A footnote adds that supervisory action may still follow from violations of law or unsafe or unsound practices stemming from insufficient management of model risk.²

The scope is narrower than the name suggests. The guidance “is expected to be most relevant to banking organizations with over $30 billion in total assets,” and says that generally excluding banks of $30 billion or less “is consistent with a tailored supervisory approach,” though it may be relevant to smaller banks with complex models.²

The definition of a model, and where machine learning sits

SR 26-2 defines a model as “a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates.”² It excludes “simple arithmetic calculations, such as those found within spreadsheets, as well as deterministic rule-based processes and software where there are no statistical, economic, or financial theories underpinning their design or use.”²

For AI the operative text is footnote 3:

“Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance.”²

The same footnote says “the principles described in this guidance apply to traditional statistical and quantitative models and non-generative, non-agentic AI models,” and that a bank’s risk management and governance practices “should guide the determination of appropriate governance and controls for any tools, processes, or systems not covered in this document.”² The guidance does not use the words “machine learning.” By its text, a machine learning model that is neither generative nor agentic is an AI model inside the scope; a large language model that drafts text or an agent that acts on its own is outside it.

Development, implementation and use

Section IV has a sentence a finance team using a vendor’s forecasting model will recognise: “Model development is not purely a technical exercise.”² Development starts with a clear statement of purpose, and testing “evaluates whether a model performs as intended,” including “out-of-sample and out-of-time testing,” comparisons of alternative assumptions and “a critical assessment of data quality, relevance, and inputs.”²

On use, the guidance warns that “Using a model beyond its intended purpose introduces additional uncertainty and risk,” and that extending a model to a new application calls for analysis of the new usage and a review of existing controls.²

Validation and effective challenge

Section V says validation “generally occurs prior to a model’s first use,” and allows use before validation in an urgent business need, with “greater attention to the model’s limitations” and controls such as “placing limits on model use or more closely monitoring its performance.”² Validation has three components in the text: conceptual soundness, outcomes analysis and ongoing monitoring.²

The conceptual soundness paragraph is the one that changes most for machine learning. It says evaluating theoretical construction may be important for some models, and that for others assessments such as “interpretability measures or benchmarking to other models” may be more practical.² For a model whose logic is learned from data rather than written down, those are the tests the guidance names in place of reading the theory.

Effective challenge appears in section III as “the critical analysis conducted by objective experts who evaluate model risk and effect appropriate changes throughout the model lifecycle.”² The people who do it need “the appropriate expertise,” “sufficient independence to maintain objectivity” and “the organizational standing and influence to effect any change.”² Section V adds that the quality of validation “depends on the rigor and effectiveness of the review rather than on organizational structure.”²

Governance, policies and documentation

Section VI asks for clear roles, an inventory and documentation. The inventory “includes sufficient information to understand model risks, so as to support effective model risk management at the individual and aggregate levels.”² Internal audit “would generally not duplicate model risk management activities such as model development or validation”; its role is “to evaluate whether the model risk management practices are rigorous and effective.”²

Section VII covers vendor and other third-party products, where most machine learning in a finance department arrives. Banks “may not receive from the vendor the underlying code, data, or methodology,” and “Nevertheless, the principles of model risk management remain applicable.”² Sound practice includes understanding the vendor model’s “conceptual soundness, design, development data, and performance” and monitoring whether it remains fit for purpose.²

What the Fed’s speakers have said about AI and model risk

Three Fed statements sit on either side of the April 2026 change, all on the Board’s own site.

Governor Michelle W. Bowman, 2024-11-22: “AI can also pose model risks in the banking context, with associated data management and governance concerns.” In the same passage: “While AI may be on the frontier of technology, it does not operate outside the existing legal and regulatory framework.”⁸

Governor Michael S. Barr, 2025-04-04, on what regulators should do about generative AI: “They should review and update existing standards on model risk management, as appropriate.”⁹

Vice Chair for Supervision Bowman, 2026-07-07, three months after SR 26-2, on the Financial Stability Board’s consultation on sound practices for AI: “lower-risk uses of AI should receive a lighter supervisory and regulatory touch,” and use and materiality “will help inform the type and intensity of the governance and controls that should be applied for the specific AI deployment.”¹¹

The GAO’s 2025 report on AI in financial services makes the point from outside the banking agencies. It recommended that the National Credit Union Administration update its model risk management guidance “to encompass a broader variety of models used by credit unions,” and its product page lists that recommendation as open.¹⁰ The report and its status are in the site’s GAO tracker.

How many bank 10-Ks name model risk, by year

EDGAR full-text search was run on 10-Ks one calendar year at a time, paged to the end, and each filing counted once by accession number; a filing counts as a bank’s when the filer’s first SIC code on EDGAR is 6021, 6022, 6035 or 6036.⁴ The phrase “model risk” appears in 33 bank 10-Ks filed in 2019, 48 in 2024 and 61 in 2025, and in 76 so far in 2026.⁴ Banks are about half of all users of the phrase: 61 of the 122 10-Ks that used it in 2025.⁴

The pairing with AI moved faster. Bank 10-Ks naming both “model risk” and “artificial intelligence” rose from 5 in 2019 to 29 in 2024 and 49 in 2025; with “machine learning”, from 1 to 10 to 17.⁴

Both phrases can sit anywhere in a filing, so the reader opened the 117 bank 10-Ks filed in 2025 and 2026 behind the AI and machine learning counts and kept the sentences naming model risk. In 114 such a sentence was found; in 37 at least one of them also names an AI term (artificial intelligence, generative AI, machine learning, AI or agentic).⁴ Twenty of those 37 filings, from 11 banks, share one sentence that begins “AI introduces model risk, where flawed algorithms or biased data could result in” and goes on to credit decisions, compliance violations and lending outcomes.⁴

The large custody banks write about the framework itself. State Street’s 10-K for 2025 says “All regulatory capital calculation models, including any artificial intelligence and machine learning models, must comply with the model risk management framework and corresponding policies.”⁷ BNY Mellon’s 10-K says its Model Risk Management framework “includes use cases employing artificial intelligence, including large language models,” and that the function is integrated into a broader artificial intelligence risk management framework.⁶ Large language models are the class SR 26-2 now leaves to general governance.²

Check status before relying on it

Bank filings did not all change their references when the guidance did. Westamerica Bancorporation’s 10-Q filed 2026-11-06 describes its interest rate model this way:

A full-text search for “SR 26-2” in 10-K and 10-Q filings from 2026-04-17 to 2026-11-10 returned no filings, and neither did the guidance’s title, “Revised Guidance on Model Risk Management.”⁴ A search for “SR 11-7” in the same forms from 2025-01-01 found nine documents, eight of them Westamerica’s.⁴

Three checks follow from the documents. The guidance in force is SR 26-2 and its attachment, dated 2026-04-17, issued jointly by the Federal Reserve, the FDIC and the OCC.¹ It is written as principles that carry no supervisory criticism on their own, with a stated focus on banks over $30 billion in total assets.² And for generative or agentic AI, the document a bank’s controls answer to is not SR 26-2 but the bank’s own governance, as footnote 3 says.² The Fed’s speeches and letters on AI are listed in the Federal Reserve tracker; every count above is recomputed from the saved search results by scripts/cfonews-ai/articles/compute.mjs in the site’s repository.