Last updated:
SR 11-7 was the US Federal Reserve and OCC's supervisory guidance on model risk management, issued on 4 April 2011. For fifteen years it set the benchmark for model validation, model inventories and independent review in US banking. It was superseded on 17 April 2026 by SR 26-2, revised guidance issued jointly by the Federal Reserve, OCC and FDIC.
Is SR 11-7 still in effect?
No. On 17 April 2026 the Federal Reserve, OCC and FDIC issued SR 26-2, Revised Guidance on Model Risk Management, which supersedes and replaces SR 11-7 and SR 21-8. In parallel, OCC Bulletin 2026-13 rescinded OCC Bulletins 2011-12, 1997-24 and 2021-19, along with the Model Risk Management booklet of the Comptroller's Handbook. Firms still referencing SR 11-7 in their policy documents need to re-baseline.
What did SR 11-7 require?
SR 11-7 rested on three pillars: robust model development, implementation and use; effective validation; and sound governance, policies and controls. Validation had three components - evaluation of conceptual soundness, ongoing monitoring, and outcomes analysis such as back-testing and benchmarking. It introduced the principle of "effective challenge": review by parties with the competence, incentive and standing to question a model. It also required a firm-wide model inventory and periodic review of each model, at least annually.
What changed under SR 26-2?
The revised guidance reflects fifteen years of supervisory experience and advances in modelling practice. Its central shift is toward an explicitly risk-based approach: model risk management practices are expected to vary according to a banking organisation's model risk profile and the size and complexity of its operations, rather than applying uniformly. The Federal Reserve states the letter is most relevant to banking organisations with over $30 billion in total assets.
Does the revised guidance cover AI models?
Only partly, and this is the critical gap. SR 26-2 states that generative AI and agentic AI models "are novel and rapidly evolving" and are not within the scope of this guidance, with the agencies planning a separate request for information on banks' use of AI. Traditional statistical and machine-learning models remain in scope; generative and agentic systems do not. Banks deploying LLM assistants, copilots or agentic workflows therefore cannot rely on model risk management guidance to govern them, and need a separate control framework - typically the FS AI RMF or the NIST AI RMF - plus an AI inventory that spans both populations.
Real world example:
A US regional bank spends 2026 re-baselining its model risk management framework against SR 26-2. Its ML-based fraud detection and credit scoring models stay in scope and keep their independent validation cycle. But its generative AI customer-service assistant and its agentic reconciliation workflow now fall outside the guidance entirely. Rather than leave them ungoverned, the bank maps both to the FS AI RMF control objectives and records them in the same inventory as its traditional models — so that when examiners ask, there is one register covering every model and AI system, with the governing framework recorded against each.
