SR 26-2 and Agentic AI: What Banking Teams Need to Know

Key takeaways

• SR 26-2 (April 17, 2026) supersedes SR 11-7 and explicitly places generative and agentic AI outside its scope. For an agent outside SR 26-2, your bank must determine what governance applies.
• A workflow can contain both SR 26-2-covered models and agents that fall outside it. You need to account for both.
• Reviewers benefit from a component-level description that separates models, retrieval, generated content and actions.
• Fed Vice Chair for Supervision Bowman said in April 2026 remarks that other risk management and governance practices are expected to support agentic AI adoption.

If your AI review still starts with an SR 11-7 checklist, there is a threshold question to answer before applying it: which parts of the system does the current guidance actually cover?

On April 17, 2026, the Federal Reserve, OCC and FDIC issued revised model risk management guidance through SR 26-2. It supersedes SR 11-7 and SR 21-8. The revised text explicitly places generative and agentic AI outside its scope.

For a bank building an agent workflow, that distinction matters. An agent might pull documents and feed a conventional risk model’s output into a recommendation it drafts. Calling the whole thing “AI” tells your reviewers very little about the components or the decisions they support.

What the revised guidance says

The guidance describes a risk-based approach tailored to a bank’s model risk profile and the size and complexity of its operations. The accompanying letter says it is expected to be most relevant to Federal Reserve-regulated banking organizations with more than $30 billion in total assets. For banks at or below that size, the guidance says excluding them is generally consistent with a tailored supervisory approach, though it may still be relevant where a bank has significant model risk exposure.

The scope language distinguishes traditional statistical and quantitative models, including non-generative and non-agentic AI, from generative and agentic AI. Footnote 3 says the latter are outside the guidance and directs banks toward their own risk management and governance practices for tools and systems it does not cover. The scope and footnote are in the guidance itself.

The guidance also states that it does not set enforceable standards or prescriptive requirements. Violations of law or unsafe or unsound practices can still lead to supervisory action.

The practical implication is that “outside SR 26-2” leaves a governance question to answer. It doesn’t establish that an agent is suitable for the proposed use or that other applicable obligations disappear.

That reading is consistent with the Federal Reserve’s subsequent explanation: Vice Chair for Supervision Bowman stated in remarks delivered at the FSOC AI Series Roundtable on April 27, 2026 and published on May 1 that other risk management and governance practices are expected to support the adoption of generative and agentic AI.

One workflow can contain different kinds of systems

Consider an illustrative lending workflow. An agent gathers borrower documents, retrieves a result from a conventional credit model and prepares a package for a credit officer. Your bank retains the lending decision.

There are several things your reviewers could examine. They might ask whether the credit model is appropriate for its intended use. They might also ask whether the agent retrieved the right borrower’s information, represented the model’s output accurately and left unresolved questions visible in the package.

Those questions are related, but answering one does not settle the others. A sound credit model could be used with the wrong inputs. A faithfully retrieved result could be described too strongly in a generated explanation. An accurate package could arrive in the wrong case.

These failure modes are hypothetical and do not describe a particular bank or product. They show why it helps to describe the workflow at the level of its components and actions, rather than applying a single label to the whole thing.

For this example, your bank would assess the conventional model against the guidance’s definition and relevant model risk practices. It would also determine the governance needed for the agent and the surrounding workflow. Adding an agent is not a reason to stop examining a model it uses.

Give reviewers something more specific than an AI label

A useful review description could begin with a simple account of the work: what starts it, what information it uses, what it produces and who receives the result.

From there, your team can distinguish the components that estimate or predict from those that retrieve, generate text or initiate actions. Mapping the agent runtime, its controls and the systems it can reach gives the technical side of that discussion a shared starting point. It can identify the controls already in the business process and the additional checks the new workflow needs.

For the lending example, that description might say that the agent assembles a credit package, uses a specified model output as one input and has no authority to approve the loan. It could identify the records used and the point where a credit officer takes over, with the agent’s owner and the human approver recorded separately. The same approach applies to other banking workflows: a reconciliation agent that investigates breaks and proposes corrections can be described in the same component-level terms, separating what the agent retrieves and proposes from what the controller approves.

That is more useful for review than a general claim of “SR 26-2 compliant AI.” The claim would obscure the very scope distinction your team needs to understand.

The description also helps when the system changes. If you later allow the agent to update a record or use a different information source, reviewers can see which part of the previously assessed workflow has changed.

Questions to bring to the review

The following is a suggested discussion checklist for an agent-supported workflow. It is not a list of requirements imposed by SR 26-2 on agents, and your bank’s model risk, compliance and legal teams should determine which questions apply to your specific workflow.

• What does each component do? Identify conventional models, generated content, retrieval and actions separately.
• How does the bank classify them? Record the basis for the scope decision and who owns it.
• Which decision does the work support? Make the relationship to the actual business process clear.
• What can the agent access or change? Describe specific permissions, including any approval conditions.
• How will you evaluate its contribution? Examine representative cases, consequential errors and the work the reviewer still performs.
• What happens when information is missing or inconsistent? Identify the receiving person and the context provided.
• What will the record explain? Include enough to connect the sources, attempted actions and human decision.
• What changes trigger another review? Consider changes to purpose, data, tools, models and permitted actions.

The right answer differs by workflow. A system preparing internal research and one contributing to a customer credit decision deserve examination in their own contexts. In discussing AI supervision, Vice Chair for Supervision Bowman emphasized understanding the use case, including materiality, access and effects on customers.

Update the reference, then examine the process

If your policies or procurement materials still cite SR 11-7, it is worth reviewing what that reference is doing. Some passages may need a straightforward update. Others may describe an internal practice your bank still wants to retain, and the reason for keeping it should now be stated clearly rather than inherited from a superseded letter.

Your model risk, compliance and technology teams can make that distinction together. The goal is to understand which expectations come from the current guidance, which come from other applicable requirements and which are your bank’s own choices about operating the workflow.

If you want the short version of the letter itself, our plain-language guide to what SR 26-2 changes and what it leaves to you covers the scope, the $30 billion asset threshold and the footnote that puts agents outside the guidance.

For an agent project, that leaves you with a more precise conversation: the work being proposed, the risks attached to it and the people responsible for deciding how it can proceed.

Moring’s AI Control Plane workshop can help frame the proposed workflow for that conversation. The workshop maps your agent’s identity, access, approval and evidence requirements onto a single control path. Regulatory interpretation and approval remain with your bank’s authorized teams. For how this plays out in a live commercial workflow, the governed banking agents pages walk through onboarding, lending exceptions and reconciliation break investigation with the review points named.

Frequently asked questions

Does SR 26-2 apply to AI agents?

Not directly. The guidance explicitly excludes generative and agentic AI from its scope (Footnote 3 of the revised guidance). It applies to traditional statistical and quantitative models, including non-generative and non-agentic AI. That exclusion is a scope decision, not a governance exemption. Your bank still needs to determine what governance applies to agents.

Does “outside SR 26-2” mean an agent needs no governance?

No. Footnote 3 of the guidance says a bank’s own risk management and governance practices should guide the controls for tools and systems the guidance does not cover. Vice Chair for Supervision Bowman made a similar point in remarks delivered on April 27, 2026 and published on May 1, saying other risk management and governance practices are expected to support adoption of generative and agentic AI.

What if a workflow contains both a conventional model and an agent?

You assess each component against the framework that applies to it. The conventional model is assessed under SR 26-2 and relevant model risk practices. The agent and the surrounding workflow require separate governance that your bank determines. The two assessments run in parallel; completing one does not substitute for the other.

Does SR 26-2 apply to banks under $30 billion in assets?

The SR letter states the guidance is expected to be most relevant to Federal Reserve-regulated banking organizations with more than $30 billion in total assets. The guidance adds that it may still be relevant to a smaller bank with significant model risk exposure, for example because its models are prevalent or complex. Smaller banks should assess applicability in their own context with their compliance and legal teams.

How should a bank describe an agent workflow for review?

Start with a component-level description: what triggers the workflow, what each component does (model, retrieval, generation, action), what the agent can access or change, where a human makes the decision, and what the record will contain. That description is more useful to reviewers than a general “AI” label, and it makes the SR 26-2 scope question answerable for each component separately.

What governance framework applies to agentic AI in banking if SR 26-2 does not?

The guidance directs banks to their own risk management and governance practices. Your bank’s model risk, compliance, technology and legal teams should determine the applicable requirements. Depending on the workflow, these may include your operational risk framework and, where the agent’s work affects customers, consumer protection obligations.

Sources

• Federal Reserve: SR 26-2, Revised Guidance on Model Risk Management
• Interagency Guidance on Model Risk Management (PDF)
• Michelle W. Bowman: Remarks at the FSOC AI Series Roundtable

Frequently asked questions

About the author

Arya SharanProduct Marketing & GTM, Moring AIChennai

Owns product marketing and go-to-market at Moring AI across positioning, demand and enablement. Works with regulated buyers on how governed AI agents are scoped, evaluated and bought. Writes about the operating questions that decide whether an agent reaches production.

LinkedIn profile →