Start with scope, purpose, materiality and evidence. A bank should inventory each AI-enabled quantitative system, define the decision it supports, rate inherent risk and business exposure, independently challenge development, validate before use, monitor for drift, and document remediation. Apply controls in proportion to the model’s complexity and the consequences of error—not by placing every “AI” tool on the same annual review schedule.
The current U.S. interagency reference is the Supervisory Guidance on Model Risk Management, revised April 17, 2026. Federal Reserve SR 26-2 supersedes SR 11-7 (2011) and SR 21-8 (2021). The guidance is supervisory and risk-based, not a prescriptive regulation, but weak controls can still contribute to supervisory concerns about violations of law or unsafe or unsound practices.
As an Amazon Associate I earn from qualifying purchases.
What is the current model-risk guidance for banks?
The Federal Reserve, Federal Deposit Insurance Corporation and Office of the Comptroller of the Currency issued revised interagency guidance on April 17, 2026. SR 26-2 is the Federal Reserve’s publication and replaces SR 11-7 and SR 21-8 as the current Federal Reserve model-risk reference.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesThe agencies describe the document as supervisory guidance rather than an enforceable checklist with fixed control frequencies. It expects a framework proportionate to an institution’s model-risk profile, size and operational complexity. The OCC release likewise says the guidance is non-prescriptive, while preserving the possibility of supervisory action when insufficient model-risk management contributes to unlawful or unsafe or unsound activity.
#1 Best Overall
The guidance is expected to be most relevant to organizations with more than $30 billion in assets. That is an applicability indicator, not a safe harbor. A smaller bank may need stronger controls if it operates many models, uses unusually complex methods, has substantial model-driven decisions or conducts activities beyond traditional community banking. Conversely, a large inventory does not automatically mean every model requires the same depth of review.
For community banks, the OCC’s 2025 clarification says validation frequency and scope can be tailored to risk, business activity and complexity. It expressly says OCC guidance does not require community banks to perform model validation every year.
Does SR 26-2 cover every AI system?
No. The guidance defines a model as a complex quantitative method, system or approach that applies statistical, economic or financial theory to inputs to produce quantitative estimates. Simple arithmetic and deterministic rule-based software without that theory basis are outside that definition.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallGenerative AI and agentic AI are expressly excluded because those technologies are novel and rapidly evolving. The guidance does not therefore provide a complete control prescription for a large language model that writes customer communications, or an agent that autonomously performs multi-step tasks. Banks should use broader governance, technology-risk, privacy, cybersecurity, consumer-protection and third-party-risk practices to determine controls for systems outside the model definition.
The principles do apply to traditional quantitative models and to non-generative, non-agentic AI models, such as a supervised-learning model that estimates probability of default or detects unusual transactions. Classify the system based on how it works and how it is used, not on whether a vendor labels it “AI.”
How do you assess AI model risk in banking?
Use the following lifecycle checklist. Create one record for each system, then evaluate dependencies and aggregate exposure across the portfolio.
1. Build an inventory that decision-makers can understand
Record systems in development and in production. At minimum, capture:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Purpose and business owner.
- Products, portfolios, customers and decisions affected.
- Inputs, outputs, assumptions and methodology.
- Data sources, quality constraints and material dependencies.
- Internal and vendor components, including proprietary elements.
- Development, validation, approval and monitoring status.
- Version, change history, known limitations and current use.
The inventory is common industry practice, but its detail should match complexity and use. A simple, low-impact scorecard may need a short record; a model that drives underwriting, capital, liquidity or regulatory reporting needs enough evidence for management and independent reviewers to reconstruct how risk is controlled. Keep both an individual view and an aggregate view: several seemingly modest models may share data, assumptions or a vendor and create concentrated risk.
2. State the intended purpose and hard boundaries
Write the decision the model supports, who uses its output, which products and populations are in scope, and when the output must not be used. Specify whether the result is an input to human judgment, an automated decision, a ranking, a forecast or a regulatory calculation.
Align data, methodology and testing with that purpose. A model built for portfolio-level forecasting should not quietly become an individual credit-decision engine. A model trained on one product, geography or time period may not be suitable for another. Treat a proposed new use as a fresh risk question: using a model outside its original purpose increases uncertainty and requires analysis of limitations and existing controls before approval.
3. Rate inherent risk and materiality proportionately
Separate what makes the method risky from how much the bank is exposed if it fails. Consider inherent risk from:
- Complexity, nonlinear behavior and key assumptions.
- Input quality, missingness, instability and data constraints.
- Opacity or difficulty explaining the output.
- Dependence on other models, systems or vendors.
Then assess exposure. How many customers, accounts or dollars are affected? Is the output used in a consequential decision, financial-risk management or a regulatory requirement? Purpose and exposure together indicate materiality. A technically sound model can still be high risk when a mistake affects a large portfolio or is used for a decision it was not designed to support.
There is no universal numeric score in the guidance. A practical comparison should examine the following dimensions:
| Dimension | Questions to ask |
|---|---|
| Purpose and criticality | What decision does the output support, and what happens if it is wrong? |
| Exposure | How many customers, accounts, dollars or regulatory reports depend on it? |
| Complexity and data | How difficult are the assumptions, dependencies and data limitations to understand? |
| Evidence and challenge | Can an independent expert reproduce, explain and test the key claims? |
| Performance and change | Does performance meet objectives, and how sensitive is it to market or population changes? |
| Aggregate and vendor risk | Are other models dependent on it, and can the bank inspect third-party components? |
| Residual limitations | What remains unresolved, how often must it be monitored, and what remediation effort is needed? |
4. Preserve development evidence and invite challenge
Document design choices, qualitative judgments, assumptions, data selection, construction and developmental testing. Depending on the model, assess conceptual soundness, interpretability, benchmarking, alternative methods and assumptions, out-of-sample or out-of-time performance, and data quality and relevance.
Testing rigor should match complexity and materiality. Ask model users and business managers to investigate unexpected results and challenge assumptions; they often know operational conditions that a development team cannot see in a dataset. Preserve rejected alternatives and the reason for selecting the final method. That record makes later change assessments and remediation decisions faster.
Recommended Free Tools
5. Validate before first use, then make an explicit use decision
Validation evaluates expected performance, reliability and limitations. It generally occurs before first use and should include conceptual-soundness review plus comparison of outputs with real-world outcomes using measures appropriate to the model’s purpose, method and available data.
Back-testing, benchmarking, sensitivity analysis and outlier analysis are possible techniques, not mandatory tests for every model. Set acceptable performance expectations in advance and identify what would trigger restrictions, recalibration or redevelopment.
If an urgent business need requires use before validation is complete, do not treat urgency as approval. Communicate the unresolved limitations, limit the scope or population, require additional human review, increase monitoring and set a deadline or condition for completing validation. Validation frequency should reflect purpose, methodology, changes, data limitations and practical constraints; neither the interagency guidance nor OCC community-bank clarification creates a universal annual calendar.
6. Monitor drift and changed conditions
Monitoring asks whether the model remains fit for its approved purpose as products, exposures, activities, customers, input relevance and market conditions change. Define metrics and thresholds before launch where practical, and assign an owner who can act on a signal.
Free tools Windows power users keep installed
One-click scans. No signup required.
Establish a response path for deterioration. Depending on the cause and severity, actions can include an overlay, adjustment, recalibration, tighter use limits, temporary suspension or redevelopment. Reassess documented limitations over time, tell users when an output should not be relied on alone, and supplement the result with other analysis when residual uncertainty is material.
7. Assign accountable and independent challenge
Policies should state expectations; procedures should specify monitoring, controls, resources and escalation. Assign named responsibility for development, validation, approval and ongoing monitoring, and address incentives that could compromise a developer’s objectivity.
Effective challenge is a lifecycle activity, not a sign-off ceremony. The agencies define it as “the critical analysis conducted by objective experts who evaluate model risk and effect appropriate changes throughout the model lifecycle, from model development to ongoing monitoring.” Challengers need suitable technical and business expertise, independence from the work being challenged and enough organizational standing to require changes or restrict use.
Internal audit generally evaluates whether the framework is rigorous and implemented. It should not simply repeat model development or validation. When outside specialists perform validation, the bank still owns oversight, acceptance of findings and remediation.
8. Control vendor and proprietary dependencies
A third party may provide data, parameters, code or a complete model. Proprietary restrictions may prevent access to source code, training data or methodology, but they do not transfer the bank’s model-risk responsibility.
Obtain enough understanding of conceptual soundness, design, development data and performance to make an informed use decision. Validate internally or through an appropriately independent outside party; monitor outcomes after deployment; and analyze performance against the bank’s own customers and objectives. Document every customization, override or overlay, explain why it was used, and evaluate whether it changes the model’s limitations or approved purpose.
If evidence cannot be obtained, treat that lack of transparency as a risk factor. Compensating controls might include narrower use, conservative limits, additional human review, more frequent monitoring or selecting a method with better evidence access.
9. Document approvals, exceptions and remediation
Maintain records that support continuity when staff, vendors or systems change. For each material decision, record:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Why the control set is proportionate to risk and materiality.
- Evidence supporting approval and the performance expectations adopted.
- Known limitations, compensating controls and prohibited uses.
- Recommendations, management responses, exceptions and due dates.
- The owner responsible for follow-up and the escalation route for overdue work.
Management should be able to understand risk at both model and portfolio level without reading every technical artifact. A concise decision record linked to supporting evidence is more useful than an unmaintained document repository.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should banks compare two models or control options?
Use the same purpose, exposure, complexity, evidence, performance, dependency and residual-limitation questions for both options. A less accurate model may be preferable if its assumptions are transparent, its data are reliable and its output can be challenged, while a marginally better-performing opaque model may require stronger restrictions. Compare the cost and feasibility of remediation as well as technical performance.
Do not convert the comparison into a made-up regulatory score. The guidance supports risk-proportionate judgment; it does not prescribe a universal weighting system. Whatever internal scoring method a bank adopts should be documented, tested for consistency and capable of explaining why a control level was selected.
Special decisions for generative and agentic AI
Because generative and agentic systems are outside the revised model guidance, first classify the risks that remain: inaccurate or fabricated content, unauthorized actions, privacy and confidentiality exposure, cybersecurity, discriminatory outcomes, records retention, explainability and third-party concentration. Apply the bank’s broader governance processes, define permitted and prohibited uses, restrict access to sensitive data, log prompts and outputs where appropriate, require human approval for consequential actions and test behavior under realistic misuse scenarios.
Do not describe an out-of-scope system as “unregulated.” The point is that the model-risk document does not fully prescribe its controls; other legal, operational and technology-risk obligations may still apply.
Common failure modes and corrective actions
- Calling every rules engine a model: Apply the definition based on quantitative theory and complexity, then document the classification and govern non-model tools through appropriate processes.
- Using an approved model for a new population: Pause the expansion, reassess purpose, data relevance and performance, and obtain approval for the changed use.
- Treating validation as an annual formality: Set frequency from risk, change and performance evidence; increase review after material changes or deterioration.
- Accepting vendor claims as validation: Obtain independent evidence, test outcomes on the bank’s use case and record transparency limits.
- Ignoring aggregate dependencies: Map shared data, vendors and upstream models so correlated weaknesses are visible to management.
- Leaving findings without owners: Assign due dates, escalation thresholds and accountable executives; close findings only when evidence shows the risk is addressed.
What a completed assessment should let management answer
At the end of the process, management should be able to identify every material AI or quantitative model, explain what decision each supports, state where it must not be used, describe the evidence for expected performance, identify who can challenge it, show how drift is detected, and account for unresolved limitations and remediation. The framework should be understandable at portfolio level as well as for individual systems.
This checklist is U.S.-focused and summarizes supervisory guidance. Institutions should apply their own legal, compliance, consumer-protection, privacy and safety requirements and confirm current agency communications, including future AI-related requests for information.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
