What SR 26-2 changes for bank AI governance

The important question after the 2026 guidance update is where responsibility for generative AI sits inside the institution. A policy gap can emerge if one team assumes the model-risk function owns the workflow while another assumes the revised scope removes it from review.

Read the scope precisely

The Federal Reserve’s SR 26-2 superseded SR 11-7 in April 2026. OCC Bulletin 2026-13 states that generative and agentic AI models are outside the revised guidance’s scope. The guidance is also tailored by institutional risk and size. Avoid describing it as a universal checklist that directly governs every Claude deployment. Federal Reserve SR 26-2.

Assign ownership across functions

For each workflow, identify the business owner and the teams responsible for information security, privacy, third parties, operations and compliance. Record which function can approve a release and which can stop it. Where the workflow includes a separate statistical model, assess that component on its own terms rather than assigning one classification to the entire system.

Keep controls connected to actual risks

Consider how an incorrect output could affect a customer, employee or regulated process. Then select controls that address that harm: source verification, approval before an action, limited permissions, testing or a manual fallback. Document why the selected controls are appropriate. Copying an old policy without revisiting the use may create paperwork without reducing the material risk.

Avoid a governance gap during policy transition

Create a short crosswalk from the old policy to the updated responsibilities. List existing AI uses, the policy they were previously reviewed under and the owner now responsible for the review. Highlight uses that have no clear approval route. The task is to maintain accountability while the institution updates its policy, not to preserve every old procedure unchanged.

For a workflow already in operation, record any temporary control arrangement and the date or event that triggers reassessment. A temporary arrangement with a named owner is more usable than an unresolved debate about terminology. Legal and risk functions should decide the institution’s applicability position; the implementation team should make the resulting controls testable.

Maintain a reviewable decision record

The record should show intended use, applicable policy, test results, known limitations and the authority granted at release. Revisit it when a new user group, data source or tool changes the exposure. This approach gives future policy updates a clear place to land without leaving current deployments unmanaged.