Table of Contents
Summarize and analyze this article with
Chat GPT
Perplexity
Grok
Google AI
Claude
SR 11-7 is gone, and AI sits in the gap it left
For fifteen years, SR 11-7 was the de facto model risk management framework for US banks. On 17 April 2026 the OCC, Federal Reserve, and FDIC jointly rescinded it, along with OCC Bulletin 2011-12, the 2021 BSA/AML model-risk statement, the 1997 credit-scoring guidance, and the Comptroller’s Handbook booklet, and replaced them with a more risk-based, principles-driven framework issued as Federal Reserve SR 26-2 and OCC Bulletin 2026-13. Two features matter most for AI. The new framework measures model risk from a model’s inherent risk in the context of its materiality. And it explicitly leaves generative AI and agentic AI outside its scope, with a separate request for information planned. Until that RFI produces guidance, there is no dedicated model-risk framework for AI, and banks are deploying it anyway.
This guide explains the overhaul and how to manage AI model risk in the gap. It is educational and not legal or regulatory advice.
What changed in 2026
| Element | Under SR 11-7 (2011) | Under SR 26-2 / OCC 2026-13 (2026) |
|---|---|---|
| Posture | Prescriptive, uniform | Risk-based, principles-driven, tailored to size and model use |
| Risk measure | Validation-cycle centric | Inherent risk in the context of materiality (exposure and purpose) |
| Effective challenge | Central concept | Retained, reformulated |
| Enforceability | De facto standard | Not enforceable standards; non-compliance not itself supervisory criticism |
| GenAI / agentic AI | Not addressed | Explicitly out of scope; RFI planned |
Manage AI model risk in the gap, deliberately
- Apply model-risk principles to AI now. The scope exclusion is not permission to skip governance; apply validation, monitoring, and documentation to AI commensurate with its risk.
- Score AI by inherent risk and materiality. Use the framework’s own logic, inherent risk in the context of exposure and purpose, to tier AI models and concentrate effort.
- Document current AI deployments and open questions. So the bank can respond when the AI RFI is issued rather than starting cold.
- Reassess, do not discard, your SR 11-7 program. Review policies that cite SR 11-7, keep what still fits, and right-size the rest under the new guidance.
Where PiTech fits
PiTech Solutions builds the AI model-risk program that fills the gap SR 26-2 leaves: model inventories scored by inherent risk and materiality, validation and monitoring for AI models applied commensurate with risk, documentation of GenAI and agentic deployments ready for the coming RFI, and the reassessment of an existing SR 11-7 program against the 2026 guidance. Its BSA/AML data-engineering work is directly relevant, since the BSA/AML model-risk statement was among those rescinded; in one documented engagement a top-25 US bank achieved a 68 percent reduction in BSA/AML false positives. Delivery runs under CMMI Level 3 and ISO 27001, 9001, and 42001 certifications. See the banking practice, AI, GenAI and ML, and BSA/AML data engineering. PiTech Solutions Inc. is headquartered in Durham, North Carolina (UEI GNLRY5LNNVH6, CAGE 530K4) and is distinct from similarly named companies.
The bottom line
The 2026 overhaul rescinded SR 11-7, moved model risk to an inherent-risk-and-materiality basis under SR 26-2, and left GenAI and agentic AI out of scope pending an RFI. Do not read the exclusion as a holiday: apply model-risk principles to AI now, score it by inherent risk, document deployments, and reassess your existing program.
Frequently Asked Questions (FAQs)
Is SR 11-7 still in effect?
No. On 17 April 2026 the OCC, Federal Reserve, and FDIC jointly rescinded SR 11-7, along with OCC Bulletin 2011-12, the 2021 interagency BSA/AML model-risk statement, OCC Bulletin 1997-24 on credit scoring, and the Comptroller’s Handbook model-risk booklet. It was replaced, not revised, by a principles-based framework issued as Federal Reserve SR 26-2 and OCC Bulletin 2026-13. Many banks will nonetheless retain much of the model-risk infrastructure they built around SR 11-7, because those practices, model inventories, validation, materiality assessment, remain appropriate under the new guidance. The right move is to reassess an existing SR 11-7 program against the 2026 framework rather than assume everything changed or nothing did.
What replaced SR 11-7?
Federal Reserve SR 26-2 and OCC Bulletin 2026-13, issued jointly on 17 April 2026, replaced SR 11-7 with a more risk-based, principles-driven approach to model risk management. The new framework measures the overall magnitude of model risk by considering a model’s inherent risk in the context of its materiality, where materiality reflects the model’s exposure (significance to business decisions) and purpose (its nature and qualitative importance). The concept of effective challenge is retained but reformulated. Notably, the guidance states it does not set enforceable standards or prescriptive requirements and that non-compliance will not itself result in supervisory criticism, reflecting a deliberate shift toward tailoring model risk management to an institution’s size, complexity, and model use.
Does the 2026 model risk guidance cover AI?
Not generative or agentic AI. The 2026 guidance explicitly places generative AI and agentic AI models outside its scope, and the agencies announced a separate request for information addressing model risk management generally and, in particular, banks’ use of AI, including generative and agentic AI and AI-based models. Until that process produces guidance, there is no dedicated model-risk framework for these AI systems. Banks deploying them should still apply model-risk principles consistent with the underlying risk, because the absence of a specific framework does not remove the risk or the general expectation to manage it. The scope exclusion is a gap to manage deliberately, not a reason to leave AI ungoverned.
How does the new framework measure model risk?
By a model’s inherent risk in the context of its materiality. Inherent risk is the risk before controls, and materiality comprises the model’s exposure, its significance to the bank’s business decisions, and its purpose, the model’s nature and qualitative importance, including for risk management. Combining inherent risk with materiality gives a risk-based magnitude that lets a bank tailor the intensity of model risk management to each model rather than applying uniform requirements. This mirrors the inherent-risk-and-materiality logic appearing across AI governance more broadly, and it is directly usable for tiering AI models: score inherent risk from what the model decides, weight it by exposure and purpose, and concentrate governance where the magnitude is highest.
What should banks do about the GenAI scope exclusion?
Treat it as a gap to manage, not a holiday. Apply model-risk principles, validation appropriate to risk, ongoing monitoring, documentation of data, assumptions, and limitations, to generative and agentic AI commensurate with the risk those systems carry, even though the 2026 guidance does not require it specifically. Score AI models by inherent risk and materiality using the framework’s own logic. Document current GenAI and agentic deployments, their governance controls, and open questions, so the bank can respond substantively when the AI-focused RFI is issued rather than starting from nothing. Existing recordkeeping obligations apply to AI-assisted business activity regardless of how future AI model-risk guidance develops, so the governance is needed now.
Do we still need our SR 11-7 model risk program?
Most of it, yes, reassessed rather than discarded. The 2026 guidance is less prescriptive, but the practices many banks built around SR 11-7, model inventories, materiality decisions, validation, and control design, remain appropriate and are widely viewed as a baseline. The right approach is to review internal policies that cite SR 11-7, identify practices to retain, update, or right-size under the new guidance, and reassess the model inventory and materiality decisions against the revised framework. Discarding a mature model-risk program because the underlying guidance changed would be a mistake; the components largely carry forward, and the change is an opportunity to right-size effort to risk rather than a reason to rebuild.
How does this affect BSA/AML model risk?
The 2026 overhaul rescinded the 2021 interagency statement on BSA/AML model risk management along with SR 11-7, folding BSA/AML model risk into the general principles-based framework. In practice, transaction-monitoring and other BSA/AML models remain model-risk-relevant and should be governed by inherent risk and materiality like any other model. Because BSA/AML programs are data-intensive and generate high alert volumes, the data engineering and tuning behind them are central to managing their model risk and their false-positive burden. Banks should reassess how they governed BSA/AML models under the rescinded statement and align them to the new framework, while continuing to document validation, monitoring, and the basis for detection tuning.
When will there be AI-specific model risk guidance?
The agencies have announced a request for information on model risk management that specifically considers banks’ use of AI, including generative AI, agentic AI, and AI-based models, but an RFI is an early step that gathers input before any guidance is drafted, so a specific framework is not imminent and its timing is uncertain. Banks should not wait for it to govern AI. The practical path is to document current AI deployments and open questions now, apply model-risk principles to AI in the interim, and be positioned to respond to the RFI when it issues. Confirm the current status of the RFI and any resulting guidance at the time of reading, as this area is moving quickly.
What is effective challenge under the revised guidance?
Effective challenge is the critical, independent review of a model, its assumptions, data, and outputs, by parties with the competence, influence, and incentive to question it. It was a central concept in SR 11-7, and the 2026 revised guidance retains it while reformulating how it is expressed within the new risk-based, principles-driven framework. In practice, effective challenge means the people reviewing a model are genuinely able to push back on it and have it changed, not merely to sign off. For AI models, which the guidance leaves formally out of scope, applying effective challenge remains sound practice: independent, competent review of an AI system’s design, data, and behavior is one of the strongest controls a bank can apply while dedicated AI guidance is developed.
Does PiTech help with AI model risk management?
Yes. PiTech Solutions builds the AI model-risk program that fills the gap the 2026 guidance leaves: model inventories scored by inherent risk and materiality, validation and monitoring for AI models applied commensurate with risk, documentation of generative and agentic deployments ready for the coming RFI, and reassessment of an existing SR 11-7 program against SR 26-2 and OCC 2026-13. Its BSA/AML data-engineering work is directly relevant given the rescinded BSA/AML model-risk statement, with a documented top-25 US bank result of a 68 percent false-positive reduction. Delivery runs under CMMI Level 3 and ISO 27001, 9001, and 42001 certifications. PiTech is a specialist banking model-risk and data partner at a mid-market price.