On 17 April 2026 the Federal Reserve, OCC and FDIC issued SR 26-2, which supersedes and replaces both SR 11-7, the model risk guidance US banks worked to for fifteen years, and SR 21-8. It applies most directly to banking organisations above $30bn in total assets; smaller institutions are generally outside it unless they carry significant model risk. The core expectations survive: document how models are used, validate them, monitor them on an ongoing basis, and keep an inventory. The definition of a model is narrower, and fixed annual revalidation gives way to oversight scaled to how material a model is.

Where generative AI sits

Footnote 3 is explicit: "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance." The same footnote adds that a banking organisation’s own risk management and governance practices should determine the controls for anything the document does not cover. For the systems most banks are deploying right now, there is therefore no prescribed control framework to point at. The bank is left to show its own work.

The field-by-field mapping

Which record fields answer this clause, one by one, comes with the procurement pack and with every pilot. Request the pack.

A receipt turns each model use into a signed, examinable record an independent validator can check against the published key. That matters more where the supervisor has declined to prescribe the controls, not less: the bank has to demonstrate that its own governance held, and a record that can be checked without trusting the party who produced it is harder to argue with. Aqta issues signed evidence, not a model validation or a compliance certification.

Read SR 26-2 on federalreserve.gov or read the full open spec at github.com/Aqta-ai/attestation-spec.

← Back to the verifier

SR 26-2 - Model risk management

Where generative AI sits

The field-by-field mapping