SR 26-2, superseding SR 11-7 - Federal Reserve, OCC and FDIC

SR 26-2 - Model risk management

On 17 April 2026 the Federal Reserve, OCC and FDIC issued SR 26-2, which supersedes and replaces SR 11-7, the model risk guidance US banks worked to for fifteen years. The core expectations survive: document how models are used, validate them, monitor them on an ongoing basis, and keep an inventory. The definition of a model is narrower, and fixed annual revalidation gives way to oversight scaled to how material a model is.

Where generative AI sits

Footnote 3 is explicit: "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance." The same footnote adds that a banking organisation’s own risk management and governance practices should determine the controls for anything the document does not cover. For the systems most banks are deploying right now, there is therefore no prescribed control framework to point at. The bank is left to show its own work.

Receipt-field mapping

modelNames the model invoked, feeding the model inventory the guidance expects
provider (when present)Names the third party that hosted the model, for vendor-model records
policy_appliedThe control under which the model was used at decision time
request_hash + outcomePer-use record of the input hash and result for ongoing monitoring
timestampWhen the model was used
signature + public_keyIndependent, verifiable record that supports effective challenge and validation

A receipt turns each model use into a signed, examinable record an independent validator can check against the published key. That matters more where the supervisor has declined to prescribe the controls, not less: the bank has to demonstrate that its own governance held, and a record that can be checked without trusting the party who produced it is harder to argue with. Aqta issues signed evidence, not a model validation or a compliance certification.

Read SR 26-2 on federalreserve.gov or read the full open spec at github.com/Aqta-ai/attestation-spec.

← Back to the verifier