SR 11-7 Explained: What Changed from SR 26-2

SR 11-7 was the 2011 supervisory guidance on model risk management that US banks followed for 15 years. On April 17, 2026, the Federal Reserve, OCC (Bulletin 2026-13) and FDIC (FIL-15-2026) replaced it with SR 26-2. The new guidance narrows what counts as a model, ties validation effort to materiality instead of a default annual cycle, lets independence be judged by the rigor of the review, and places generative and agentic AI outside its scope. The core disciplines of validation, effective challenge and monitoring stay. This guide compares the two, explains what to do about it, and shows how Madison, Lyzr’s agentic GRC product for US banks and credit unions, traces a change like this through a bank’s own policies and controls.

TL;DR

• What happened: SR 26-2 replaced SR 11-7 on April 17, 2026. It also supersedes SR 21-8, the 2021 statement on BSA/AML systems.
• What changed: a narrower model definition, materiality-based tiering, a risk-based validation cadence instead of a default annual one, independence judged by rigor, and a $30B reference point for relevance.
• What did not: conceptual soundness, ongoing monitoring, outcomes analysis, effective challenge, vendor accountability and board oversight.
• The AI carve-out: generative and agentic AI are outside SR 26-2. They are still governed by the bank’s own risk management and controls.
• The work: reclassify the inventory, rewrite policy, tier by materiality, test vendor evidence and decide how to govern AI.
• Our answer: Madison traces the change to the obligations, policies, procedures and controls it touches and shows the gaps. It does not validate models.

What was SR 11-7?

SR 11-7 was the Federal Reserve’s supervisory guidance on model risk management, issued in April 2011. The OCC issued it as Bulletin 2011-12, and the FDIC adopted it in 2017. It defined a model as a quantitative method, system or approach that applies statistical, economic, financial or mathematical theories to turn input data into quantitative estimates, and it built a framework around three validation elements: conceptual soundness, ongoing monitoring and outcomes analysis. It also made effective challenge, critical analysis by objective, informed parties who can identify a model’s limitations and get changes made, a central expectation.

In practice the broad definition pulled many spreadsheets and simple tools into model risk cycles, and many banks defaulted to annual validation. SR 11-7 was written before large language models, and it did not contemplate AI directly.

What is SR 26-2?

SR 26-2 is the revised guidance, dated April 17, 2026 and issued jointly by the Federal Reserve, the OCC (as Bulletin 2026-13) and the FDIC (as FIL-15-2026). It supersedes SR 11-7 and SR 21-8, and the OCC rescinded its own earlier bulletins and handbook booklet on model risk. It is guidance, not an enforceable rule: falling short of it alone should not bring supervisory criticism, though unsafe or unsound practices still can.

SR 11-7 vs SR 26-2: what changed?

The table below sets the two side by side. It draws on law-firm and vendor summaries, listed in the sources, because we have not reproduced the guidance text. Check each row against the Federal Reserve, OCC and FDIC originals.

Sources: Duczer East, Auditrol, Internal Audit Guide and Sia Partners (see Sources). Auditrol is a vendor. The FDIC $1B detail is from Internal Audit Guide and should be verified.

What counts as a model now?

The narrower definition is the change that touches the most inventories. Summaries of SR 26-2 describe a model as a complex quantitative method grounded in statistical, economic or financial theory, and say simple spreadsheet arithmetic and deterministic rules fall outside it. That does not mean those tools go ungoverned. One practitioner reading suggests classifying each entry as a model, a non-model tool or out-of-scope AI, with a written rationale, and keeping non-model tools under end-user computing or application controls.

Illustrative classifications based on summaries of the guidance. Your own written criteria decide.

How do materiality tiering and validation change?

Under SR 26-2, summaries say materiality is set by a model’s purpose together with its exposure, with some commentators adding inherent risk and reliance. Validation effort and frequency follow from that. Immaterial models need basic identification and monitoring, and heavy validation concentrates on the models that matter most. There is no validation calendar: validation generally happens before first use, with timing driven by the model and its materiality.

Illustrative only. One published worked example uses annual, two-year and three-year review cycles by tier, and it is the author’s example, not a requirement of SR 26-2. Set your own tiers and document why.

The practical test is that tiering must produce visibly different depth and frequency. If every model is validated annually, the tiering is cosmetic, and an examiner or internal auditor will see it.

What stayed the same?

The disciplines of SR 11-7 carry over. What changed is how much effort goes where:

1. Conceptual soundness.

The model’s design, assumptions and limitations still need to make sense and be documented.

2. Effective challenge.

Independent, informed review that can get changes made. Independence is judged by rigor, not only the reporting line.

3. Monitoring and outcomes.

Ongoing monitoring and outcomes analysis remain mandatory, with evidence that the monitoring was reviewed.

4. Accountability.

Institutions remain fully responsible for vendor models, and board and senior management oversight is still the backbone.

What happens to generative and agentic AI?

SR 11-7 did not contemplate them. SR 26-2 addresses them only to exclude them: it states that generative and agentic AI models are novel and rapidly evolving and are not within the scope of the guidance. A footnote, according to one practitioner reading, directs that a bank’s broader risk management and governance practices should determine the controls for uncovered uses. Traditional statistical models and non-generative, non-agentic AI, such as machine learning credit and fraud models, remain in scope.

The exclusion is not an exemption. The same reading says supervisors can reach generative AI through third-party risk, operational resilience, information security and consumer protection, and that the agencies have signalled a request for information on model risk and AI that had not been issued at the time of writing. We cover this gap in depth in SR 26-2 and the banking AI governance gap.

Does SR 26-2 apply to a smaller bank?

SR 11-7 was scaled to a bank’s size and complexity but had no asset reference point in the guidance. SR 26-2 is described as most relevant to banking organizations above about $30 billion in total assets. Summaries add that it may apply below that line where model use is complex or activities go beyond traditional community banking, and that smaller institutions may concentrate on material, higher-risk models.

The $30B figure is a relevance reference in summaries, not a bright-line test. Confirm the wording in the primary text.

What should a bank do now?

One vendor article sequences the work over 120 days, but that timing is its own recommendation. The steps themselves are what matter.

Step 1: Reclassify the inventoryTest every entry against the narrower definition and label it a model, a non-model tool or out-of-scope AI, with a written rationale. Keep excluded tools under end-user computing or application controls.

Step 2: Define and apply tieringWrite criteria for purpose and exposure, tier the inventory and make sure the tiers produce different validation depth and frequency.

Step 3: Rewrite policyRemove SR 11-7 prescriptive language, such as default annual validation, and take the revised policy to the board or risk committee.

Step 4: Test vendor model evidenceDo not rely on vendor documentation alone. Show your own understanding of how vendor models were validated.

Step 5: Build monitoring evidenceSet thresholds, drift detection and escalation, and keep evidence that monitoring was reviewed.

Step 6: Decide how to govern AIWrite a scope decision for generative and agentic AI, with an inventory, owners and approvals. See AI agent inventory for banks.

How does Madison trace a change like this?

A guidance change is only useful once you know what it touches in your own bank. Madison is Lyzr’s agentic GRC product for US banks and credit unions. It holds regulation, obligations, policies, procedures, controls, tests, findings and evidence as one connected model, so when guidance changes it shows your analysts what is affected: the duties it creates, the policies that carry them, and the procedures and controls underneath. Agents propose, a named person decides, and the decision is signed against the exact version.

One boundary to be clear about: Madison is not a model validation tool and does not replace your validators. It maps what the guidance requires to your policies and controls and shows where coverage has gaps.

What SR 26-2 touches in a bank, and how Madison approaches it

Illustrative of how a guidance change flows through a connected model. It is not a customer case or a measured result.

Start with your own library. The first Madison working session is built around your documents: you bring your model risk policy and procedures as they stand today and leave with a coverage map of them, and the gaps in it.

Where does Opencontroller fit?

Because SR 26-2 leaves generative and agentic AI to the bank, the agents themselves need governing. Opencontroller by Lyzr is the control plane for that: a registry with an immutable ID and a named owner for each agent, approvals with separation of duties, a signed audit trail, and a simulation engine with a regression gate for re-testing after a change. It runs in your own cloud account and complements, rather than replaces, your GRC and model risk tools.

Madison answers what the guidance means for your policies and controls. Opencontroller keeps the agents accountable. See the AI agent registry guide.

See what SR 26-2 touches in your bank

Bring your model risk policy and procedures to a working session. We will show what Madison traces, where it sees gaps and what a named person approves.

Book a demo

Explore Madison

Frequently asked questions

What is SR 11-7?

SR 11-7 was the Federal Reserve’s supervisory guidance on model risk management, issued in April 2011 and issued by the OCC as Bulletin 2011-12. It defined a model broadly as a quantitative method turning inputs into quantitative estimates, and built its framework on conceptual soundness, ongoing monitoring, outcomes analysis and effective challenge.

What replaced SR 11-7?

SR 26-2 replaced SR 11-7. It is dated April 17, 2026 and was issued jointly by the Federal Reserve, the OCC (as Bulletin 2026-13) and the FDIC (as FIL-15-2026). It also supersedes SR 21-8, the 2021 statement on BSA/AML systems.

What is the difference between SR 11-7 and SR 26-2?

SR 26-2 narrows the definition of a model, ties validation effort to materiality instead of a default annual cycle, judges independence by the rigor of the review rather than reporting lines, treats BSA/AML systems under the same guidance, and places generative and agentic AI outside its scope. Conceptual soundness, monitoring, outcomes analysis and effective challenge carry over.

When did SR 26-2 take effect?

SR 26-2 is dated April 17, 2026. The summaries we reviewed do not describe a separate compliance deadline, and the guidance is not an enforceable rule. Check the agencies’ texts and your examiner’s expectations for any transition arrangements.

What counts as a model under SR 26-2?

Summaries describe a model as a complex quantitative method grounded in statistical, economic or financial theory. Simple arithmetic, such as typical spreadsheet calculations, and deterministic rule-based processes are excluded. Machine learning credit and fraud models remain in scope.

Does SR 26-2 still require annual model validation?

No default annual cycle is described. Summaries say validation generally happens before first use, with timing and intensity driven by the model’s materiality, and that banks should document a rationale for the cadence they choose.

Does SR 26-2 apply to generative AI and agentic AI?

No. SR 26-2 states that generative and agentic AI models are novel and rapidly evolving and are not within its scope. A bank’s own risk management and governance practices should still determine the controls for them, and supervisors can reach them through third-party risk, information security and operational resilience.

Does SR 26-2 apply to banks under $30 billion?

SR 26-2 is described as most relevant to banks with more than about $30 billion in total assets. Smaller banks use it as a proportionate reference, and it may apply where model use is complex. It is a relevance reference, not a bright-line test, so confirm the wording and agree your approach with your examiner.

What did not change from SR 11-7 to SR 26-2?

Conceptual soundness, ongoing monitoring, outcomes analysis and effective challenge remain core expectations, along with vendor accountability and board and senior management oversight. What changed is how much effort goes where, based on materiality.

Is SR 26-2 mandatory?

SR 26-2 is supervisory guidance, not an enforceable rule. Summaries say falling short of it alone should not bring supervisory criticism, but unsafe or unsound practices stemming from weak model risk management still can. Treat it as the benchmark examiners will use.

How does Madison help with a guidance change like SR 26-2?

Madison is Lyzr’s agentic GRC product for US banks and credit unions. It holds regulation, obligations, policies, procedures, controls and evidence as one connected model, so a change shows what it touches and where coverage has gaps, and a named person decides. Madison does not validate models or replace your validators.

Where does Opencontroller fit alongside Madison?

Because SR 26-2 leaves generative and agentic AI to the bank, the agents need governing. Opencontroller by Lyzr registers each agent with an immutable ID and a named owner, enforces approvals with separation of duties, keeps a signed audit trail and provides a simulation engine with a regression gate. It runs in your own cloud account.

Book A Demo: Click Here
Join our Slack: Click Here
Link to our GitHub: Click Here