An SR 26-2 compliance checklist for a bank’s model risk team covers eight items: scope classification for every model and AI application, a proportionality tier matched to asset size and model risk exposure, a current inventory, a validation cadence tied to each model’s risk tier, vendor and third-party model controls under the June 2023 interagency guidance, documentation an examiner can review without reconstruction, a separate governance track for generative and agentic AI that SR 26-2 excludes by name, and a board reporting line that ties all seven together. Most programs built under SR 11-7 already have the first six in some form. The seventh, the generative and agentic AI gap, is where nearly every program we review has nothing written down at all.
This guide walks through each of the eight items with the specific evidence a model risk team should be able to produce for each one, a proportionality table for sizing the effort to institution size, and a self-scoring worksheet you can run before an examiner runs one for you.
Why a checklist, not just a reading of the guidance
SR 26-2 is principles-based supervisory guidance. The Federal Reserve’s text, mirrored in OCC Bulletin 2026-13 and the FDIC’s parallel statement, states plainly that it “does not set forth enforceable standards or prescriptive requirements.” That framing is accurate, and it is also why so many model risk teams stall after reading it: principles describe a sound program in the abstract, not the artifact to pull from the shared drive when an examiner asks for it. A checklist translates the principle into the artifact.
The checklist below is organized around what an examiner actually asks for during a model risk review, not around the structure of the guidance document itself. Where SR 26-2 changed something meaningful from SR 11-7, we flag it, because a program built entirely on the 2011 text will have gaps a 2026 reading closes.
The eight-part SR 26-2 compliance checklist
1. Scope classification for every model and AI application. SR 26-2 narrows applicability to “traditional models and basic AI applications.” That phrase does more work than it looks like it does, because the guidance does not draw a bright line between a basic AI application and a generative or agentic one. A logistic regression credit scorecard is clearly in scope. A large language model used for customer drafting is clearly out. A machine learning fraud-detection model sits closer to the boundary and needs a documented classification decision, not a default assumption either way. The evidence an examiner expects: a written classification for each system stating which category it falls into and why, signed off by someone with the authority to make that call.
2. A proportionality tier matched to institution size and exposure. SR 26-2 is risk-based rather than uniform. The guidance is expected to apply most fully to institutions above thirty billion dollars in total assets, with proportional application below that threshold scaled to model risk exposure rather than asset size alone. A community bank with a handful of low-materiality models should not be running a program sized for a regional bank’s full model inventory, and should be able to show the reasoning behind that scaling, not just claim it informally.
| Tier | Typical profile | What the program needs to show |
|---|---|---|
| Tier 1 | Over thirty billion dollars in assets, or smaller with high-materiality AI/model use | Full validation cadence, independent review function, documented governance committee, complete vendor model register |
| Tier 2 | Regional or community bank, moderate model count and materiality | Risk-tiered validation (not every model at the same depth), named model owners, documented proportionality rationale |
| Tier 3 | Small institution, few models, low individual materiality | Lightweight inventory and annual review, documented rationale for why a fuller program is not warranted |
3. A current model and AI application inventory. This is the foundation every other item depends on, and the item examiners test first because a stale or incomplete inventory undermines everything built on it. The inventory needs vendor-embedded models, not only internally built ones: a loan origination platform, a fraud tool, or a pricing engine often ships a model the bank never built and never flagged.
4. A validation cadence tied to risk tier, not a calendar default. SR 26-2 continues SR 11-7’s core validation principles: conceptual soundness, ongoing monitoring, and outcomes analysis, each at a depth matching the model’s materiality. A program that validates every model on the same annual schedule regardless of risk tier applies 2011-era uniformity to guidance that explicitly asks for proportionality in 2026. The evidence: a validation schedule with depth varying by tier, and the rationale documented once rather than argued fresh at each review.
5. Vendor and third-party model controls. SR 26-2 gives more explicit attention to externally sourced models than SR 11-7 did, alongside the existing interagency third-party risk management guidance the Fed, OCC, and FDIC finalized in June 2023 under the framework OCC Bulletin 2013-29 first established. A provider that silently updates a model you rely on has changed a model in your inventory, so the contract needs to say so: notice of material model changes, data use terms, and audit access are the three clauses to confirm in every AI and model vendor contract, not just the general service-level terms procurement defaults to.
6. Documentation an examiner can review without reconstruction. Every item above produces a named artifact: a classification memo, a proportionality rationale, an inventory, a validation schedule, a vendor control register. The test is whether someone outside the model risk function could assemble the evidence from what already exists, rather than the team building a one-time packet the week before an exam.
7. A separate governance track for generative and agentic AI. This is the item most SR 11-7-era programs are missing entirely. SR 26-2 explicitly excludes generative AI and agentic AI from model risk scope, describing them as “novel and rapidly evolving” and leaving them to other risk-management practices. That is not a safe harbor: a customer-service LLM, a drafting copilot, or a multi-step agent still faces examination exposure through fair lending law (ECOA and Regulation B), UDAP, and the existing third-party risk framework, none of which carry a generative AI exclusion. A checklist that stops at “SR 26-2 does not apply to our LLM” has found a gap, not closed one. The evidence needed: an inventory of generative and agentic AI use cases tracked separately from the model risk inventory, a governance framework for that inventory (most programs anchor this to the NIST AI RMF’s GOVERN, MAP, MEASURE, and MANAGE functions), and a named owner accountable for that track the same way a model owner is accountable for a model.
8. A board or senior-management reporting line. SR 26-2 continues the expectation that model risk, however it is organized, rolls up to a level of oversight that can see the whole picture: the inventory, the proportionality rationale, vendor exposure, and the separate generative and agentic AI track together. A reporting line that covers traditional models but never mentions the generative AI inventory leaves the board approving a partial picture.
A checklist that only swaps the words “SR 11-7” for “SR 26-2” without addressing the scope boundary, the proportionality rationale, and the vendor-model attention above has not actually closed the gap between the two letters.
A self-scoring worksheet
Score each row 0, 1, or 2 before an examiner scores it for you. A 2 means the evidence exists today and is current; a 0 means it does not exist.
| Checklist item | 0 (missing) | 1 (partial) | 2 (current and documented) |
|---|---|---|---|
| Scope classification | No written classification for any system | Some systems classified, boundary cases undecided | Every model and AI application has a signed classification |
| Proportionality tier | No documented rationale for program size | Informal sense of scale, nothing written | Tier assigned with documented rationale tied to size and exposure |
| Inventory | No current inventory, or vendor-embedded models missing | Inventory exists, vendor models incomplete | Inventory current, includes vendor-embedded AI and models |
| Validation cadence | Same depth and schedule for every model | Some risk-based variation, not formalized | Validation depth and frequency documented by risk tier |
| Vendor and third-party controls | Contracts silent on model-change notice and audit access | Some contracts cover it, not reviewed systematically | All AI and model vendor contracts reviewed for notice, data use, and audit terms |
| Documentation | Evidence would need to be rebuilt for an exam | Most evidence exists, scattered across owners | Evidence assembles from existing records without reconstruction |
| Generative and agentic AI track | No separate inventory or governance for GenAI/agentic systems | Inventory exists, no governance framework or owner | Separate inventory, governance framework, and named owner in place |
| Board reporting | Board sees traditional model risk only | Board sees both but not as one integrated report | Board receives one report covering models and GenAI/agentic AI together |
Total out of 16. Below 8, start with the inventory and the generative AI track, since both items feed every other row. Above 12, the remaining work is closing specific gaps rather than building the program from scratch.
How this fits with NIST AI RMF and third-party risk guidance
A bank’s full governance picture needs three pieces visible at once: SR 26-2 for the traditional models and basic AI applications it covers, the NIST AI RMF (GOVERN, MAP, MEASURE, MANAGE) as the organizing structure for the generative and agentic AI SR 26-2 sets aside, and the June 2023 interagency third-party guidance for every model or AI application sourced from a vendor. ISO/IEC 42001:2023 can support procurement and board assurance for AI management systems, but US examiners assess AI risk through SR 26-2, fair lending law, UDAP, and third-party risk guidance, not through ISO certification. For the full comparison of what changed between the two supervisory letters, see SR 26-2 vs SR 11-7: what changed for AI model risk management.
Questions buyers ask
Does SR 26-2 apply to our generative AI chatbot?
No. SR 26-2 explicitly excludes generative AI and agentic AI from its model risk scope, describing them as novel and rapidly evolving and leaving them to other risk-management practices. That does not remove examination exposure. Fair lending law, UDAP, and third-party risk guidance still apply to a generative AI chatbot regardless of the SR 26-2 carve-out, which is why a separate governance track for these systems belongs in the checklist rather than being treated as out of scope entirely.
Is SR 26-2 a binding regulation our bank must certify against?
No. SR 26-2 is non-binding supervisory guidance. The OCC’s parallel bulletin states directly that it does not set forth enforceable standards or prescriptive requirements and that non-compliance will not by itself result in supervisory criticism. In practice, examiners still assess whether an institution’s model risk program reflects sound practices aligned with the guidance’s principles, so treating it as optional carries its own risk even though it is not a rule.
How is the proportionality requirement actually applied?
SR 26-2 is expected to apply most fully to institutions above thirty billion dollars in total assets, with proportional application to smaller institutions scaled to their model risk exposure rather than asset size alone. A smaller bank with limited model use should document the rationale for a lighter-weight program rather than assume proportionality applies automatically without a written basis.
What is the single biggest gap model risk teams have under SR 26-2?
The generative and agentic AI governance track. Most SR 11-7-era programs have a working inventory, validation cadence, and vendor review process for traditional models. Very few have built a parallel, documented governance structure for the generative and agentic AI that SR 26-2 explicitly excludes, which leaves that fast-growing category of AI use without the evidence an examiner would expect to see if asked about it.
Can DSE certify that our program satisfies SR 26-2?
No. DSE prepares institutions for audit and examination by building the inventory, classification, validation, and evidence structure a model risk program needs, and the work is organized to be audit-ready and supervisory-framework-aligned. DSE does not certify compliance or guarantee any examination outcome; that determination rests with your examiners and your own model risk function.
The Bottom Line
An SR 26-2 compliance checklist is not a rewrite of what model risk teams already do under SR 11-7, it is an extension that adds a scope boundary, a proportionality rationale, sharper vendor-model controls, and, most importantly, a governance track for the generative and agentic AI the guidance explicitly sets aside. Score your program against the eight items above before an examiner does. The inventory and the generative AI governance gap are where the work should start, because every other row on the checklist depends on one or the other being solid first.
Building or reconciling a model risk program against SR 26-2 and the generative and agentic AI governance gap it leaves open is exactly the work our AI governance consulting engagement is built for. Start with the AI governance checklist to see whether your inventory, classification, and evidence would hold up against an examiner’s request today, or review finserv compliance for the broader financial-services compliance picture.
Key facts
- SR 26-2, issued by the Federal Reserve on April 17, 2026 alongside OCC Bulletin 2026-13 and a parallel FDIC statement, replaces SR 11-7 and narrows model risk guidance to traditional models and basic AI applications, explicitly excluding generative and agentic AI (DSE, 2026).
- A model risk team's SR 26-2 compliance checklist has eight working parts: scope classification, proportionality tier, inventory, validation cadence, vendor and third-party model controls, documentation, the generative and agentic AI governance gap, and board reporting (DSE, 2026).