For more than 15 years, SR 11-7 served as the foundational framework for Model Risk Management (MRM) across the U.S. banking industry. It established the modern principles of model governance, independent validation, conceptual soundness, outcomes analysis, and ongoing monitoring.
In April 2026, U.S. banking regulators introduced SR 26-2, formally replacing SR 11-7 and modernizing supervisory expectations for model risk management. While the core philosophy of sound governance remains intact, the regulatory posture has shifted significantly from a highly prescriptive framework toward a more flexible, risk-based, and principles-driven approach.
The change is far more important than many organizations initially realize. This is not simply a documentation update. It represents a fundamental evolution in how regulators expect institutions to think about governance, proportionality, accountability, and operational flexibility.
What SR 11-7 Originally Established
Federal Reserve SR 11-7, introduced in 2011, was designed to address the growing dependence on quantitative models in banking institutions. It established expectations around:
Independent model validation
Model inventories and classification
Governance and oversight
Ongoing performance monitoring
Effective challenge
Documentation standards
Vendor model oversight
The framework became the backbone of model governance programs across major financial institutions and heavily influenced global MRM practices. ()
Over time, however, many institutions operationalized SR 11-7 as a rigid compliance checklistrather than a dynamic risk management discipline.
What Changed in SR 26-2
1. From Prescriptive Controls to Principles-Based Supervision
One of the biggest changes is philosophical. SR 11-7 was highly detailed and frequently interpreted as mandatory operational doctrine. SR 26-2 explicitly clarifies that the guidance is not a prescriptive rulebook and should not automatically result in supervisory criticism if implemented differently.This shifts the burden back to institutions. Organizations are now expected to justify and defend their governance decisions based on risk, materiality, and operational context rather than merely demonstrating checklist compliance.
The implication is significant:The quality of governance judgment now matters more than procedural conformity.
2. Risk-Based Validation Replaces Annual Validation Expectations
Under SR 11-7, many institutions evolved toward annual revalidation cycles regardless of actual model risk. SR 26-2 explicitly moves toward a proportional, risk-based validation cadence tied to:
Model materiality
Change velocity
Data volatility
Business criticality
Operational exposure
This allows institutions to focus validation resources where risk is highest instead of applying uniform review schedules across all models.For mature organizations, this may substantially improve operational efficiency. For immature organizations, it introduces additional governance complexity because proportionality must now be defensible.
3. Narrower Definition of “Model”
SR 26-2 narrows the formal definition of a model. Simple deterministic calculations, spreadsheets, and rule-based logic may no longer fall under full MRM scope in many situations. This change could significantly reduce governance overhead for low-risk tools and operational utilities. However, it also creates new challenges around classification consistency and scope determination.Expect future regulatory scrutiny around how institutions classify borderline systems.
4. Independence Is Reframed Around “Effective Challenge”
SR 11-7 strongly emphasized organizational independence between developers and validators. SR 26-2 reframes this concept by emphasizing the effectiveness and rigor of the challenge process rather than strict organizational separation.This is particularly important for modern AI development environments where governance increasingly needs to be embedded directly into engineering workflows rather than functioning as a detached after-the-fact checkpoint.In practical terms: Governance is shifting left.
5. Tailoring Expectations to Institutional Complexity
SR 26-2 explicitly recognizes that governance frameworks should scale proportionally based on:
Institution size
Model complexity
Risk exposure
Operational footprint
The guidance is primarily targeted toward institutions above $30 billion in assets, while allowing more proportional implementation for smaller organizations. This formalizes a trend regulators had already been signaling for several years.
6. Aggregate Risk and Model Interdependencies
SR 26-2 explicitly directs institutions to assess model risk both individually and in aggregate, accounting for interactions, dependencies, shared assumptions, common data sources, and reused methodologies.In an era of foundation models, embedding pipelines, and shared feature stores, this is not optional. It is the new baseline.
7. Streamlined Vendor and Third-Party Model Validation
The revised guidance simplifies expectations for how banks validate vendor models, recognizing that institutions cannot always replicate vendor methodologies and that effective challenge of a vendor model looks different than effective challenge of an internally developed one.
8. Generative AI and Agentic AI Are Explicitly Excluded
One of the most interesting aspects of SR 26-2 is what it does not cover. The guidance explicitly states that Generative AI and Agentic AI systems are outside its scope because they are still rapidly evolving technologies.This does not mean these systems are outside governance expectations. Quite the opposite. The agencies have signaled a forthcoming Request for Information (RFI) specifically addressing AI, including generative and agentic systems.
This is not a free pass. SR 26-2 states clearly that a bank's existing risk management and governance practices should guide controls for tools and systems outside the document's scope. The principles of materiality, effective challenge, ongoing monitoring, and sound governance still apply.
For institutions building agentic AI capability today, the carveout is best read as both an opportunity and a responsibility. The banks that establish robust, scalable governance frameworks for agentic AI now, ahead of a formal rulebook, will compress the distance between experimentation and production.The banks that wait will accept elevated risk or fall behind on adoption.
This means institutions must build parallel governance frameworks capable of addressing risks that traditional MRM structures were never designed to manage, including:
Non-deterministic behavior
Prompt injection
Hallucinations
Autonomous tool usage
Agent orchestration risk
Memory persistence
Dynamic reasoning chains
Human-AI collaboration risks
This is where traditional MRM frameworks begin intersecting with:
NIST AI RMF
EU AI Act
AI governance architectures
AgentOps
Runtime guardrails
Continuous evaluation pipelines
What Did Not Change:Despite the modernization effort, the core intellectual foundation of SR 11-7 remains intact. SR 26-2 still preserves:
Effective challenge
Conceptual soundness validation
Outcomes analysis
Ongoing monitoring
Governance accountability
Vendor oversight responsibilities
The objective is not deregulation. The objective is modernization.
What Critiques of SR26-2 Say
Critiques of SR 26-2 generally fall into several major themes. While many institutions welcome the modernization and flexibility,critics argue that the guidance may unintentionally weaken consistency, increase ambiguity, and create governance gaps precisely at a time when AI and model complexity are accelerating.
Here are the main criticisms emerging from risk professionals, governance practitioners, consultants, and banking analysts:
1. “Too Much Flexibility Creates Ambiguity”
One of the biggest criticisms is that SR 26-2 shifts heavily toward principles-based supervision without providing enough operational specificity. SR 26-2 gives institutions more discretion to tailor controls proportionally. Critics argue this may create:
inconsistent implementation across banks
weaker governance standards
increased supervisory interpretation risk
uncertainty during examinations
In practice, some institutions may use “risk-based flexibility” responsibly, while others may use it to reduce governance rigor and cost.
2. Reduced Validation Requirements May Weaken Oversight
Another major concern is the move away from implicitly expected annual validations. This is particularly concerning for:
rapidly changing ML systems
models exposed to volatile markets
AI systems using external data sources
continuously learning environments
Some practitioners believe annual validation became excessive under SR 11-7. Others argue that removing stronger cadence expectations could create dangerous inconsistency.
3. Narrower Definition of What Constitutes a “Model” Could Create Governance Loopholes
Critics argue this may allow institutions to:
intentionally classify systems outside MRM scope
avoid validation obligations
reduce governance costs
fragment accountability
This becomes particularly problematic in modern AI architectures where:
workflows combine deterministic and probabilistic components
spreadsheets connect to ML systems
orchestration layers influence outcomes
business rules indirectly drive AI behavior
Critics worry organizations may begin “scope engineering” to minimize regulatory burden.
4. “Effective Challenge” May Become Harder to Enforce
SR 26-2 de-emphasizes strict organizational independence and instead focuses on “effective challenge.”
Critics worry this language may:
weaken separation of duties
reduce validator authority
create conflicts of interest
blur accountability boundaries
This is especially concerning in organizations under:
delivery pressure
AI adoption pressure
budget constraints
aggressive modernization timelines
Some fear validation teams may gradually lose independence while institutions still claim they provide “effective challenge.”
5. Potential for Regulatory Inconsistency Across Examiners
Because SR 26-2 is less prescriptive, another concern is examiner inconsistency.
Different regulators or examination teams may interpret differently.
Ironically, more flexible guidance can sometimes increase regulatory uncertainty because organizations no longer know exactly where the supervisory boundaries sit.
6. Smaller Institutions May Struggle More, Not Less
Although the guidance aims to reduce burden for smaller banks, some critics argue the opposite may happen.
This is because proportional governance requires:
mature risk judgment
strong classification frameworks
governance expertise
operational sophistication
Large institutions usually already possess these capabilities. Smaller institutions may struggle to:
justify governance decisions
demonstrate defensibility
define proportionality consistently
In other words: A principles-based framework often benefits mature organizations more than less mature ones.
7. The Guidance Still Focuses Primarily on “Models,” Not Systems
This is one of the deeper architectural criticisms. Modern enterprise AI risk increasingly emerges not from individual models, but from:
workflows
orchestration
agent interactions
retrieval pipelines
tool access
runtime decisions
human-AI collaboration
infrastructure dependencies
Critics argue SR 26-2 still fundamentally inherits a “single model” worldview. But modern AI systems are increasingly:
ecosystems
interconnected services
adaptive workflows
autonomous decision chains
This creates governance blind spots.
8. Generative AI Exclusion Is Viewed as a Major Gap
One of the most discussed criticisms is that SR 26-2 explicitly excludes Generative AI and Agentic AI from its scope. Many governance professionals see this as the largest weakness in the guidance. The concern is not that GenAI should be governed exactly like traditional models.
The concern is that:
GenAI is already being deployed in banking
LLMs are influencing decisions
AI agents are interacting with enterprise systems
runtime autonomy introduces new operational risks
Critics argue regulators modernized MRM at the exact moment the industry is transitioning beyond traditional models.
Some believe SR 26-2 is already partially outdated because it focuses primarily on classical MRM concepts while the industry is moving toward:
autonomous workflows
tool-using agents
multi-agent orchestration
dynamic reasoning systems
probabilistic non-deterministic outputs
The Broader Debate
The debate around SR 26-2 ultimately reflects a larger tension in enterprise AI governance:
Should regulation be:
prescriptive and enforceable? or
flexible and innovation-friendly?
Too much rigidity can slow innovation. Too much flexibility can weaken accountability. SR 26-2 clearly leans toward flexibility, proportionality, and institutional discretion.
Supporters view that as modernization. Critics worry it may reduce governance consistency exactly when AI risk complexity is exploding. That tension will likely define the next decade of AI governance in financial services.
Final Thoughts
The transition from SR 11-7 to SR 26-2 reflects a broader regulatory evolution happening across enterprise AI governance globally.Regulators are increasingly moving away from rigid procedural prescriptions and toward outcome-oriented governance expectations. This creates both opportunity and responsibility.
Organizations with mature governance cultures will gain flexibility and operational efficiency. Organizations dependent on checklist-driven compliance may struggle because judgment, proportionality, and defensibility are now becoming central supervisory expectations.
Most importantly, SR 26-2 indirectly signals something larger:Traditional model risk management alone is no longer sufficient for the next generation of AI systems.
The future of enterprise AI governance will require combining:
Model Risk Management
AI Governance
Runtime Controls
Effective Guardrails
Agentic Oversight
SR 11-7 vs SR 26-2
What Practitioners Should Do Now
If you lead model risk, AI governance, or digital transformation in a regulated institution, SR 26-2 creates a window to do five things well:
Re-baseline the model inventory against the narrower model definition.
Implement a defensible materiality framework that drives proportionate governance.
Build, or extend, a governance overlay for generative and agentic AI that mirrors SR 26-2 principles even though those systems sit outside scope.
Refresh validation standards and effective challenge practices, focusing on rigor rather than structural separation.
Prepare a position for the forthcoming AI RFI, because the institutions that shape the next framework are the ones already living its principles.
SR 11-7 defined a generation of model risk management. SR 26-2 sets the conditions for the next one, and the institutions that move first will define what good looks like for generative and agentic AI long before the regulators write it down.
Explore more: Start Here · Topics · Archive · About