Not Within the Scope of This Guidance: Generative AI in the US Bank Regulators' Model Risk Guidance of April 2026

On April 17, 2026, the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation and the Office of the Comptroller of the Currency issued revised Supervisory Guidance on Model Risk Management, the attachment to SR Letter 26-2.

A model, for the guidance, is "a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates." Model risk, it says, can lead to financial loss, to errors in financial statements and reporting, and to flawed financial and risk management decisions, "among other types of risk events." And it says what it is not: "This guidance does not set forth enforceable standards or prescriptive requirements; accordingly, non-compliance with this guidance will not result in supervisory criticism against a banking organization." Its first footnote adds that "supervisory action may result for any violations of law or unsafe or unsound practices stemming from insufficient management of model risk."

Parts of the guidance follow, not the whole.

What It Covers, and What It Leaves Out

The guidance is expected to be "most relevant to banking organizations" with more than $30 billion in total assets. Then: "However, in some situations, this guidance also may be relevant" to banking organizations of that size or less "that have significant exposure to model risk because of the prevalence and complexity of their models or because of activities outside the scope of traditional community banking." Its term "model" leaves out simple arithmetic, such as a spreadsheet's, and deterministic rule-based processes and software with no "statistical, economic, or financial theories underpinning their design or use."

Its third footnote turns to AI. "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance." "Nonetheless," it continues, a banking organization's risk management and governance practices "should guide the determination of appropriate governance and controls for any tools, processes, or systems not covered in this document." And the principles, it says, "apply to traditional statistical and quantitative models and non-generative, non-agentic AI models."

Generative and agentic models sit in a footnote, outside the guidance. For them, the guidance points a bank back to its own practices.

Vendor and Other Third-Party Products

The guidance says the "widespread use of customized vendor and other third-party products" can "present unique challenges for validation and other model risk management activities." Banking organizations, it says, "may not receive from the vendor the underlying code, data, or methodology that they would have if a model were developed internally." Then: "Nevertheless, the principles of model risk management remain applicable."

Validating vendor products, "either by internal or outside parties," is in its words "an important element of model risk management." Sound practice includes developing an understanding of the vendor model, "including its conceptual soundness, design, development data, and performance," along with ongoing monitoring and outcome analysis to assess whether vendor models "are accurate, remain fit for purpose, and continue to be reliable."

Effective Challenge, Validation and Governance

Sound model risk management, the guidance says, involves "effective challenge," which it describes as critical analysis by "objective experts" who evaluate model risk and bring about appropriate changes across a model's life, from its development to its ongoing monitoring. The people who perform it have the expertise for a critical and objective challenge, "sufficient independence to maintain objectivity," and the standing and influence in the organization to effect change.

Where internal audit is part of a bank's model risk management, its role "is generally to evaluate whether the model risk management practices are rigorous and effective and whether related policies are implemented accordingly." And "Adequate documentation helps to support effective model risk management."

"Validation generally occurs prior to a model's first use," the guidance says. "However, certain circumstances (e.g., an urgent business need) may necessitate using the model before validation is completed." In those cases, sound practice involves greater attention to the model's limitations, telling the people concerned about them, and controls such as limits on its use or closer monitoring.

On validation, the guidance also states a limit. "Even with sound modeling practices and rigorous validation, material model risk can remain."