Model Risk for AI: Extending SR 11-7 to Systems That Act

In April, the US banking agencies rewrote fifteen years of model risk doctrine and drew agentic AI explicitly outside the perimeter. The discipline still transfers. The supervisory checklist does not exist. A CFO who waits for one will spend the interim running systems that act with no validation function watching them.

The Perimeter Just Moved

For fifteen years, the reference document for governing quantitative systems in American finance was a supervisory letter. The Federal Reserve's SR 11-7 and its OCC twin, Bulletin 2011-12, issued jointly on April 4, 2011, told banks how to develop, validate, and govern models. Its vocabulary escaped banking long ago. Insurers, asset managers, and corporate risk teams borrowed its framework because nothing better existed.

On April 17, 2026, the Federal Reserve, the OCC, and the FDIC replaced it. SR 26-2, the Revised Guidance on Model Risk Management, supersedes both SR 11-7 and the 2021 interagency statement on models supporting anti-money-laundering compliance. The revision narrows the perimeter in three ways that matter for this discussion.

First, applicability. The agencies state the guidance is "expected to be most relevant to banking organizations with over $30 billion in total assets." The 2011 framework had reached far smaller institutions in practice; the FDIC's 2017 adoption applied it to institutions with $1 billion or more in total assets.

Second, enforceability. The new text is explicit in a way the old one never was: the guidance "does not set forth enforceable standards or prescriptive requirements; accordingly, non-compliance with this guidance will not result in supervisory criticism against a banking organization."

Third, and most consequential, scope. The revised definition of a model now requires complexity and excludes "simple arithmetic calculations" and "deterministic rule-based processes." Then, in a footnote that deserves more attention than most of the body text, the agencies write: "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance." The principles apply to traditional statistical models and to non-generative, non-agentic AI. For the excluded systems, the footnote points organizations back to their own general risk management and governance practices. The systems that generate and the systems that act sit outside the fence. The agencies said alongside the release that they plan a separate request for information on banks' use of AI. A request for information gathers comment. It obligates nothing, and no such framework is in force today.

Read the three moves together and the position is stark. The most consequential class of systems now entering finance functions is the one class the in-force framework declines to cover.

What the 2011 Doctrine Actually Said

To decide what to carry across, start with what the original text said, because most secondhand summaries flatten it.

SR 11-7 defined a model as "a quantitative method, system, or approach that applies statistical, economic, financial, or mathematical theories, techniques, and assumptions to process input data into quantitative estimates." A model, it continued, consists of three components: an information input component, which delivers assumptions and data to the model; a processing component, which transforms inputs into estimates; and a reporting component, which translates the estimates into useful business information.

Note the load-bearing word: estimates. The 2011 model produces a number. A human reads the number and decides. Every control in the document is built on that assumption. Model risk was defined as "the potential for adverse consequences from decisions based on incorrect or misused model outputs and reports," and it arises in exactly two ways: the model has fundamental errors, or the model is used incorrectly or inappropriately. The decision-maker is always a person standing between the output and the world.

The framework rested on three elements: robust development, implementation, and use; a sound validation process; and governance with defined roles and the authority to restrict model usage. Validation itself carried three components, retained almost verbatim in the 2026 revision: conceptual soundness, ongoing monitoring, and outcomes analysis.

Its guiding principle was "effective challenge": in the 2011 wording, "critical analysis by objective, informed parties who can identify model limitations and assumptions and produce appropriate changes," depending on "a combination of incentives, competence, and influence." The 2026 revision reformulates the triad as expertise, sufficient independence to maintain objectivity, and "the organizational standing and influence to effect any change." The idea survives both drafts intact: someone who did not build the system, who understands it anyway, and who can force a change must examine it before and while it is used.

That is the doctrine. It is a good one. It is also built end to end on the premise that the system's output is an estimate a human consumes.

The Systems Now Deployed Do Not Produce Estimates

That premise is what current deployment breaks, and the deployment is not hypothetical. KPMG's Q2 2026 AI Pulse survey, fielded between April 28 and May 25 among 204 US C-suite and business leaders at organizations with more than $1 billion in revenue, found 53% already using AI agents, with orchestration of multiple agents across workflows doubling in a single quarter, from 9% to 18%. Gartner's advice to CFOs, published August 20, 2026, is that early agent pilots are most likely to fail on unclear controls rather than poor technology, and that governance should be piloted before the use case scales.

An agentic system does not deliver a quantitative estimate to a human reader. It initiates a payment, releases an order, files a report, sends the email, calls another system's API, and then reads the result and chooses its next step. Three properties of these systems break specific load-bearing assumptions of the model risk framework.

Non-determinism breaks outcomes analysis as written. SR 11-7's outcomes analysis compares model outputs to realized results, back-testing being the canonical form. That works when the same input reliably produces the same output. A generative system can produce different, individually defensible action sequences from identical starting conditions. You are no longer validating a function. You are characterizing a distribution of behaviors, which demands evaluation at a scale and frequency the annual validation cycle never contemplated.

The unbounded input space breaks testing coverage. A credit scoring model takes a defined vector of inputs. An agent ingests free text, documents, tool outputs, and the live state of other systems. No test suite enumerates that space. Coverage becomes statistical confidence rather than exhaustive verification, and the honest statement of assurance changes from "tested" to "sampled under stated conditions."

Action authority and chained tool calls break the containment assumption. The 2011 framework's implicit safety net was the human between estimate and decision. When the system executes, the error cost is no longer a bad number on a report. It is a transaction. And when one agent's output is another agent's input, a single upstream deviation propagates at machine speed. The 2026 guidance itself flags aggregate model risk from interactions and dependencies among models. Chained agents are that warning made kinetic.

What transfers cleanly? More than the pessimists concede. Conceptual soundness transfers: the question "is this system's design fit for its stated purpose, on evidence" does not care whether the output is an estimate or an action. Ongoing monitoring transfers and grows in importance, shifting from quarterly performance reports toward runtime observation. Effective challenge transfers wholesale, because it is a property of organizations, not of models. What does not transfer is the cadence, the coverage arithmetic, and the comfortable assumption that a person stands at the exit.

Doctrine element	Agentic systems	Why
Conceptual soundness	Transfers	Design fitness on evidence does not depend on whether the output is an estimate or an action.
Ongoing monitoring	Transfers, grows	Shifts from quarterly performance reports toward runtime observation.
Effective challenge	Transfers wholesale	A property of organizations, not of models.
Outcomes analysis	Breaks	Non-determinism: identical inputs yield different defensible action sequences. A distribution, not a function.
Testing coverage	Breaks	Unbounded inputs: assurance becomes "sampled under stated conditions," not "tested."
Human containment	Breaks	The system executes. Errors are transactions, and chained agents propagate them at machine speed.

The Corporate Translation

Banks above $30 billion in assets at least have examiners asking questions; press reporting through mid-2026 indicates US supervisors have begun raising AI governance, vendor risk, and shutdown procedures in routine examinations. A corporate CFO has no examiner and no mandate. That is precisely the argument for borrowing the discipline, because the alternative is running systems that act with nothing watching them but uptime dashboards. The KPMG numbers say that is the current state: among the same organizations where 53% run agents, only 36% have implemented direct token or usage controls, only 26% report full real-time visibility into AI operating costs, and 32% place accountability for AI-informed decisions with the CEO or executive committee. If cost metering, the cheapest instrumentation there is, is missing at nearly two thirds of the organizations surveyed, behavioral instrumentation is missing at more.

Five elements of the bank framework translate directly into decisions a CFO can take this quarter.

1. An inventory keyed to action authority, not to model typeThe bank inventory lists models. The corporate version lists permissions: which systems can move money, commit the firm, communicate externally, or alter records, and under what limits. We made the companion argument for boards in our analysis of what the board must approve; the CFO owns the finance slice of that inventory and the attestation that it is complete.
2. Materiality tiering, which the 2026 revision strengthensSR 26-2's most useful upgrade is a risk-based frame: materiality as the product of model exposure and model purpose, with lighter oversight for immaterial systems and rigorous oversight for material ones. A drafting assistant and a payment-releasing agent do not deserve the same regime. Tier by the worst action the system can take unattended, not by how impressive the technology is.
3. Validation before authority, proportionate to the tierFor an agentic system this means behavioral evaluation: scenario suites including adversarial inputs, sampled rather than exhaustive, with documented coverage and known failure modes, run before the system receives its permissions and re-run when the underlying model or the toolset changes. The 2026 guidance's own language helps here: validation quality depends on "the rigor and effectiveness of the review," not on where the reviewers sit on the organization chart. A mid-size corporate can meet that standard without a bank's validation department.
4. Ongoing monitoring as runtime bounds plus evidenceLogs of every action taken, spend and volume limits enforced outside the agent's own control, anomaly triggers, and defined conditions under which the system's authority is suspended. The record matters as much as the restraint: when something goes wrong, the question will be which system, which version, which authority, and on whose approval.
5. A challenge function that is realBoth drafts of the doctrine agree on the essentials: expertise, independence, and standing. In a corporate without a second line of defense, this can be one named senior person outside the deploying team, with written authority to halt a deployment and a reporting line that does not pass through the executive who sponsored it. What it cannot be is the vendor's assurance deck or the deploying team marking its own work.

None of this requires waiting for the agencies' request for information to become something more. The 2011 doctrine spent fifteen years proving that estimate-producing models repay disciplined skepticism. The systems now being deployed act instead of estimating, the in-force framework has formally stepped back from them, and Gartner's June 2025 projection that over 40% of agentic projects will be canceled by end-2027, in part on inadequate risk controls, suggests the cost of skipping the discipline is already being paid. The firms that extend the doctrine themselves, rather than waiting to be told, are the ones we expect to still be running their agents in 2028. That conviction is also why we argued that governance capacity is becoming a priced attribute rather than a compliance cost.

Sources

Primary supervisory documents accessed and verified 31 August 2026. Survey figures carry the fielding dates stated in the text.

• Board of Governors of the Federal Reserve System, OCC, Supervisory Guidance on Model Risk Management, SR 11-7 / OCC Bulletin 2011-12, April 4, 2011.
• Board of Governors of the Federal Reserve System, FDIC, OCC, Revised Guidance on Model Risk Management, SR 26-2 / OCC Bulletin 2026-13, April 17, 2026.
• Federal Deposit Insurance Corporation, Adoption of Supervisory Guidance on Model Risk Management, FIL-22-2017, June 7, 2017.
• KPMG, AI Quarterly Pulse Survey, Q2 2026, fielded April 28 to May 25, 2026, published June 24, 2026.
• Gartner, Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027, press release, June 25, 2025.
• Gartner, CFOs Must Pilot Governance First Before Scaling AI Agents, August 20, 2026.
• Press reporting on AI in routine bank examinations (Quartz; ABA Banking Journal; ACA International), June 2026.
• GSC, AI Governance in Finance: What the Board Must Approve, August 24, 2026.