The carve-out is not a grace period
Fifteen years. That is how long banks waited for new model risk guidance.
It arrived in April. SR 26-2, replacing 2011’s SR 11-7. And the newest risk in the building is not in it: generative and agentic AI models are out of scope, with separate guidance signaled and not yet issued. In its place, one pointer: the bank’s own risk management and governance practices decide.
Read that twice. For the AI that acts, the program you write is the playbook your examiners will read.
So what do you write? The obvious answer is maximum caution: route every agent to the top committee. I designed exactly that for a reference governance framework, and when I stress-tested it before anything ran, it failed. A calendar assistant faced the same committee, the same forms, the same weeks of waiting as an agent that can move money. Run a bank that way and two things follow: the committee drowns, and people quietly stop registering agents. Then the inventory is fiction, and the riskiest agent is the one nobody has heard of. Maximum scrutiny for every agent means meaningful scrutiny for none.
The design that survived the test, and the one I argued to the Financial Stability Board in two comment letters this summer: route review by what an agent can actually reach and do. Its ceiling. Does it only show a person an answer, or can it send, file, and pay on its own? Can it touch anything outside the bank? Can it direct other agents?
A news summarizer and a payment executor can run on the same model. The summarizer’s class gets its boundary approved once, instances enroll automatically, and anything past the boundary goes to individual review. The payment agent gets the full committee. And the committee gets its time back to take seriously the one that deserves it.
The agencies sent SR 26-2 to institutions above $30 billion. SR 11-7’s principles reached exam rooms far below that for fifteen years. Expect these to travel too.
The carve-out is not a grace period. It is a map of where the next hard exam question is standing.
- Board of Governors of the Federal Reserve System, SR 26-2, the guidance itself and its boundary language: federalreserve.gov
- Financial Stability Board, the consultation my two comment letters went to: fsb.org. My filed comments: 15 July and 19 July.
Scope note. SR 26-2 was sent to institutions above $30 billion. It is supervisory guidance for banking organizations, not a rule, and it is not addressed to credit unions.
Written for compliance and risk readers in regulated financial firms. Informational, not legal advice; Mike Bidun is not a lawyer.