How to Govern Generative AI at a US Bank After SR 26-2

Current as of October 29, 2026. This guide describes US federal banking guidance and the NIST frameworks as published on that date, with UK and Canadian guidance for comparison. It is not legal advice.

On April 17, 2026 the Federal Reserve, the OCC and the FDIC issued revised model risk management guidance: SR 26-2 at the Federal Reserve, which supersedes and replaces SR 11-7, the guidance US banks had organized around since 2011, and FIL-15-2026 at the FDIC, which rescinded the FDIC's adoption of it. The new text keeps the familiar disciplines of inventory, validation, effective challenge, monitoring and documentation. It also draws a line that matters for every bank deploying generative AI: "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance."

That leaves a bank to decide for itself how to govern its chatbots, copilots, document tools and agents. The guidance says only that "a banking organization's risk management and governance practices should guide the determination of appropriate governance and controls for any tools, processes, or systems not covered in this document." This guide sets out eight steps to doing that in a way the bank can explain to its board and its examiners. Unless a step quotes a rule or guidance, it is this guide's recommendation, not a requirement.

Step 1: Sort your inventory into what the guidance covers and what it does not

Start from the model inventory you already keep. Mark each entry as a traditional or non-generative model, which SR 26-2 covers, or as a generative or agentic system, which it does not. Then add the generative AI the inventory does not yet list: copilots in office software, generative features inside vendor platforms, and tools that staff use directly. NIST's Generative AI Profile suggests organizations "Enumerate organizational GAI systems for incorporation into AI system inventory and adjust AI system inventory requirements to account for GAI risks."

The sort matters because the two groups now have different anchors. The first is governed against the revised guidance; the second against whatever framework the bank writes for it.

Step 2: Write the generative AI framework as part of model and risk governance

The guidance tells banks to let their own risk management and governance practices decide the controls for generative AI. The most defensible way to do that is to extend the disciplines the bank already applies to models rather than to build a separate regime (interpretation). The revised guidance itself describes what those disciplines are for: "an effective model inventory includes sufficient information to understand model risks", validation "evaluates whether models perform as expected and includes an assessment of a model's reliability and its limitations", and ongoing monitoring asks whether a model is "performing as expected given potential changes in products, exposures, activities, clients, data relevance, or market conditions."

Write down which of those apply to generative AI as written, which are adapted, and why. NIST describes its AI Risk Management Framework as "intended for voluntary use", and NIST says it "is being revised as part of the White House AI Action Plan"; it is a useful structure to borrow, not an obligation.

Step 3: Tier generative AI by what it is used for

The revised guidance emphasizes "a risk-based approach to model risk management that is tailored to a banking organization's model risk profile and the size and complexity of its operations", and says "Model risk is influenced by a model's inherent risk, exposure, purpose, and use". Those factors translate directly to generative AI (interpretation): an internal drafting assistant reviewed by its user carries different risk from a tool that answers customers, and both differ from an agent that can take action. Set the depth of review, testing and approval by tier, and record who can change a tier.

Step 4: Test before use, with challenge from people who did not build it

Effective challenge, in the revised guidance's words, is "performed by individuals with the appropriate expertise to conduct a critical and objective challenge, sufficient independence to maintain objectivity, as well as the organizational standing and influence to effect any change." The same independence is worth keeping for generative AI even though the guidance does not require it there (interpretation).

Testing has to fit the technology. NIST warns that "Risks from confabulations may arise when users believe false content – often due to the confident nature of the response – leading users to act upon or promote the false information." Test each use for the failures that matter in it (interpretation): wrong answers stated confidently, leakage of customer data, responses outside policy, and behavior under adversarial prompts. Keep the test sets, so the same tests can be re-run when the underlying model changes.

Step 5: Put limits and logs around agents

Agents deserve their own tier (interpretation). In a January 2026 blog post, FINRA, the broker-dealer regulator, described AI agents as "systems or programs that can perform and complete tasks autonomously, without human intervention." For a bank, the practical controls are the ones that make an autonomous action reversible and reviewable (interpretation): limit what each agent is permitted to do and in which systems, require human approval for actions above a threshold the bank sets, log every action with the inputs behind it, and give someone the authority and means to stop it.

Step 6: Bring vendor generative AI into scope

Much of a bank's generative AI will arrive inside vendor products. For the models it covers, the revised guidance is clear that opacity is not an excuse: "Additionally, because certain components may be proprietary, banking organizations may not receive from the vendor the underlying code, data, or methodology that they would have if a model were developed internally. Nevertheless, the principles of model risk management remain applicable." Applying the same stance to vendor generative AI (interpretation) means asking vendors for the information that testing and monitoring need, and testing the bank's own use of the product when the vendor cannot provide it.

Third-party risk management guidance is also changing. The federal banking agencies and the NCUA proposed new interagency guidance in September 2026, stating they "plan to rescind and replace existing guidance on third-party risk management". The proposal does not address AI specifically, and it is a proposal; plan against current guidance and watch for the final text.

Step 7: Monitor in production and decide what triggers a review

Generative AI adds change triggers of its own (interpretation): the vendor updates the underlying model, prompts change, and the documents a tool draws on change. Treat each of those as an event that can trigger re-testing, alongside the conditions the revised guidance lists for models. Monitor outputs by sampling them against the tests from Step 4, and track incidents and complaints that involve AI.

Step 8: Report to the board, and align across jurisdictions

Report generative AI risk to the board in the same cycle as model risk, by tier, with the open issues and the exceptions granted (interpretation). Banks operating outside the US should note that neither of the following texts excludes generative AI the way SR 26-2 does. Canada's OSFI Guideline E-23, effective May 1, 2027, defines a model to include "AI/ML methods". The UK PRA's SS1/23, which applies to UK-incorporated banks, building societies and PRA-designated investment firms with internal model approval, and does not mention AI by name, expects "a complete and accurate set of information relevant to manage model risk for all of the models that are implemented for use, under development for implementation, or decommissioned." One group framework that meets each applicable text is simpler to run than three (interpretation).

Checklist

• The model inventory marks each entry as covered by SR 26-2 or as generative or agentic AI
• Generative AI in office software, vendor platforms and staff tools has been added to the inventory
• A written framework says how generative AI is governed, and which model risk practices apply, are adapted or are not used
• Generative AI uses are tiered by what they are used for, with tier-based review and approval
• Pre-use testing covers confabulation, data leakage, out-of-policy responses and adversarial prompts
• Test sets are kept so they can be re-run when the underlying model changes
• Reviewers are independent of the people who built or bought the tool
• Agents have defined permissions, approval thresholds, action logs and a stop control
• Vendor generative AI is in scope, with information requests and the bank's own testing
• Model updates, prompt changes and source-document changes trigger re-testing
• Generative AI risk is reported to the board by tier, with exceptions
• The framework is checked against OSFI E-23 (effective May 1, 2027) and PRA SS1/23 where they apply
• The proposed interagency third-party guidance is tracked until finalized

How we sourced this guide: every factual statement in it is drawn from published rules, regulatory guidance and other public documents, and we keep a full set of sources and citations for it. If you would like them, or want to question a point, get in touch through our contact page and we will share them.