SR 26-2, the revised interagency guidance on model risk management issued April 17, 2026, states that generative AI and agentic AI models "are not within the scope of this guidance." Banks now deploy their fastest-growing AI systems outside the framework that governed models for fifteen years, and the promised request for information has not yet been published.

What did SR 26-2 change on April 17, 2026?

The Federal Reserve, OCC and FDIC jointly issued SR 26-2, "Revised Guidance on Model Risk Management", on April 17, 2026. It supersedes SR 11-7 (April 4, 2011) and SR 21-8. The OCC issued the same text as Bulletin 2026-13, rescinding Bulletins 2011-12, 1997-24 and 2021-19 and the Comptroller's Handbook booklet on model risk. The FDIC issued it as FIL-15-2026.

Three changes matter for AI governance teams. The definition of a model narrowed to "a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates," excluding simple arithmetic and deterministic rules. Oversight became materiality-based. And generative and agentic AI were removed from scope entirely.

The guidance is "expected to be most relevant to banking organizations with over $30 billion in total assets," and it is not a rule. The FDIC's cover letter states that "non-compliance with this guidance alone will not result in supervisory criticism." Supervisory action remains available for violations of law or unsafe and unsound practices.

What does the generative and agentic AI carve-out actually say?

The operative text is two sentences: "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance."

The guidance then draws the line on the other side. Its principles "apply to traditional statistical and quantitative models and non-generative, non-agentic AI models." A gradient-boosted credit decisioning model or a machine learning fraud model remains a model under SR 26-2 and is subject to identification, validation and ongoing monitoring in the usual way.

The guidance does not define either term. It does not say generative systems are not models, or that they should be governed less. It says only that this document does not cover them, and that banks should apply their broader risk management and governance practices to tools it does not address.

Per the OCC's release, they "plan to issue in the near future a request for information that addresses model risk management generally and considers, in particular, banks' use of AI, including generative AI and agentic AI and AI-based models." As of September 14, 2026, no RFI has been published.

Does "out of scope" mean generative AI is unregulated at a bank?

No. Out of scope for one piece of supervisory guidance is not the same as outside supervision. Every law that applies to a decision, a disclosure or a customer interaction applies whatever technology produced it.

A generative system that drafts adverse action reasons is subject to the Equal Credit Opportunity Act and Regulation B. A customer-facing agent that describes products is subject to the UDAAP prohibitions in sections 1031 and 1036 of the Dodd-Frank Act. A vendor-hosted large language model is a third-party relationship under the 2023 Interagency Guidance on Third-Party Relationships: Risk Management (SR 23-4). Operational resilience, BSA/AML, privacy and record-keeping obligations attach as they always did.

Vice Chair for Supervision Michelle Bowman addressed the point in a May 1, 2026, speech: "Today, banks are relying on existing risk-management frameworks to guide their use of AI." She also gave part of the motive for the carve-out: "over time, supervisors expanded the scope of the previous guidance beyond its original purpose to apply it in unintended ways."

The gap is specific: the legal obligations exist and the examiner questions will come, but the one document that told a model risk function how to demonstrate control does not apply to the systems that raise the sharpest questions.

Which AI systems still fall under SR 26-2?

Two edge cases need a documented position. A system that pairs a traditional classifier with a generative summarizer contains an in-scope model feeding an out-of-scope one. An agent that calls an in-scope credit model as a tool does not remove that model from SR 26-2; it adds an ungoverned layer on top. Record which category each system sits in, and why, in the AI inventory, because the answer determines which control set applies.

What should a bank do with generative and agentic AI in the interim?

A bank has three main options to address generative and agentic AI in the interim.

The first is to force generative and agentic systems into the existing model risk management program. Validation techniques built for a probability of default model do not transfer to a system whose outputs are non-deterministic, whose behavior changes when the vendor updates the base model, and whose risk lies in actions taken across tools. Bowman's remark about guidance applied "in unintended ways" reads as a caution against exactly this.

The second is to leave them ungoverned until the RFI resolves into guidance, which leaves the bank exposed on every legal obligation above with no evidence trail when an examiner asks how a customer-facing agent was approved.

The third path, and the one that most banks are now taking, is a parallel framework for generative and agentic systems that borrows what still applies from MRM, adds the controls those systems need, and is built to be reconciled with whatever the agencies eventually issue. At minimum it needs:

• A definition of generative and agentic AI recorded as an inventory attribute, so every system is classified against the SR 26-2 boundary.

• Risk tiering by autonomy and consequence: what the system can do without a human, and what happens when it is wrong.

• Use-case approval before deployment, with the approver separate from the builder.

• Evaluation evidence retained with the base model version and prompt configuration it was run against.

• Vendor assessment covering change notification, data handling and subprocessors.

• Human oversight and a defined stop mechanism for any agent with write access to a system of record.

• Monitoring of outputs and actions, reporting into the existing risk committee.

The reference control sets already exist. The NIST Generative AI Profile (NIST AI 600-1, July 2024) maps twelve generative AI risk categories to the GOVERN, MAP, MEASURE and MANAGE functions. The Financial Services AI Risk Management Framework (FS AI RMF), published by the Cyber Risk Institute in February 2026, contains 230 control objectives aligned to the NIST AI RMF. Both are voluntary and both give a bank a citable basis for interim controls. Enzai's agentic AI governance guide covers the agent-specific controls in depth.

Portability is crucial. A bank that has recorded which systems are generative or agentic, who approved them, what they were tested against and what controls apply can map that evidence to whatever the agencies issue after the RFI. A bank whose approvals live in email threads will start again. Enzai's compliance frameworks module is built for this pattern: evidence is captured once against a system and reused across every framework that applies, including the FS AI RMF and NIST AI RMF, so a future SR letter becomes another mapping and not a new program.

How does the carve-out interact with PRA SS1/23, MAS, the FS AI RMF and the EU AI Act?

Large banks are supervised in several jurisdictions at once, and the US carve-out is the outlier. No other regime a global bank is likely to face excludes generative or agentic systems.

PRA SS1/23 applies to UK-incorporated banks, building societies and PRA-designated investment firms with internal model approval (IRB, IMA or IMM). The supervisory statement states expressly that insurers and reinsurers are not in scope. It defines a model as "a quantitative method, system, or approach that applies statistical, economic, financial, or mathematical theories, techniques, and assumptions to process input data into output," with no generative or agentic carve-out. A UK subsidiary of a US bank with IRB permission therefore faces a broader model definition in London than its parent faces in New York, and all five SS1/23 principles apply to any generative system that meets it.

MAS has run the opposite course. The FEAT principles of November 12, 2018, are non-binding. In November 2025 MAS consulted on Guidelines on AI Risk Management for financial institutions, closing January 31, 2026. The draft addresses complex AI "including Generative AI and AI agents" and proposes a twelve-month transition after final issue. A bank with a Singapore entity should expect its agentic systems to be inside MAS guidelines before the US agencies have finished consulting.

The FS AI RMF was developed by the Cyber Risk Institute in coordination with the Financial Services Sector Coordinating Council through a Treasury-convened public-private process. It is industry-led and voluntary, not regulator-issued, and it does not replace SR 26-2. Its value is as a ready-made control library for the interim framework.

The EU AI Act is technology-neutral. Creditworthiness assessment and credit scoring of natural persons is listed in Annex III, point 5(b), and life and health insurance risk assessment and pricing in point 5(c). A generative system used for either is high-risk regardless of architecture. Article 17(4) lets financial institutions satisfy most of the quality management system requirement through the internal governance EU financial services law already requires, which is where MRM and AI governance have to be reconciled anyway. The Digital Omnibus on AI (Regulation (EU) 2026/1744) entered into force on July 27, 2026, and moved Annex III high-risk obligations to December 2, 2027, and Annex I systems to August 2, 2028. Enzai's EU AI Act compliance guide covers the deadline table in full.

What is the timeline of supervisory changes?

What is still uncertain?

The RFI has no date. "In the near future" was written in April 2026, and an RFI is a request for information, not a proposal, so any guidance will follow a further comment cycle.

The eventual scope is open. The agencies could extend the model definition to cover generative systems, issue standalone AI guidance, or fold expectations into existing guidance on third-party risk and operational resilience. The RFI's framing, "model risk management generally," leaves every route available.

Examiner practice in the interim is undocumented. Bowman's speech describes banks relying on existing frameworks, not how examiners will treat a bank whose generative systems have none.

The definitions are open. SR 26-2 does not define generative or agentic AI. Until the agencies do, each bank's own definition is the one it will be examined against, and it should be written down.

What this means operationally

For a governance team at any bank deploying generative or agentic systems, the work is concrete.

1. Classify every AI system in the inventory against the SR 26-2 boundary: traditional model, non-generative AI model, generative, agentic, or not a model. Record the rationale. Mixed systems get a component-level answer.

2. Stand up a documented interim framework for the generative and agentic population, using the NIST Generative AI Profile and the FS AI RMF as control sources. Route it through the committee that owns model risk, so governance of the two populations stays coordinated.

3. Capture evidence against systems, not against frameworks. Approvals, evaluations, vendor assessments and monitoring results should attach to a specific system and version, so they can be mapped to multiple frameworks now and re-mapped when the RFI produces guidance.

4. Reconcile with the other regimes the group is subject to. A UK subsidiary with IRB permission may find its generative systems meet the SS1/23 model definition. An EU footprint touching credit or insurance decisions makes December 2, 2027, the planning horizon.

5. Prepare the RFI response now. A bank with an inventory and an interim framework can comment from evidence. It is also the moment to align the owners of model risk and AI governance, because the RFI is where the agencies will decide whether those become one discipline or two.

Enzai is built for the third step in particular: one system record, one evidence trail, mapped across every framework that applies, which is the pattern behind automated AI governance for a GRC function. To see how that works for a financial institution, talk to the Enzai team.