SR 11-7 no longer exists. On April 17, 2026, the Federal Reserve, OCC and FDIC replaced it with revised model risk guidance (SR 26-2 and OCC Bulletin 2026-13) that leaves generative and agentic AI explicitly out of scope. That doesn't make genAI unsupervised. It now falls under general risk management, third-party risk and governance, and state examiners have a new AI framework to work from.
If your AI policy says "we govern ChatGPT under SR 11-7," it's citing guidance that has been replaced. Here's what replaced it, and what a community bank should do now.
What changed in April 2026?
| Before | After April 17, 2026 | |
|---|---|---|
| Guidance | SR 11-7 and OCC Bulletin 2011-12 | SR 26-2 and OCC Bulletin 2026-13, issued jointly with the FDIC |
| Generative and agentic AI | Many banks applied model risk rules to them | "Not within the scope of this guidance" |
| Who it targets | All banks | Most relevant to banking organizations with over $30 billion in assets; may apply to smaller banks with significant model risk |
| Enforcement | Supervisory expectations | Non-compliance "will not result in supervisory criticism" |
| What's next | The agencies plan a request for information on AI, including generative and agentic AI |
Traditional models, such as credit scoring, still belong in model risk management. The change is that genAI tools like Claude, Gemini or Copilot no longer fit there.
If genAI is out of model risk scope, what governs it?
The rules you already have. In remarks published May 1, 2026, Fed Vice Chair for Supervision Michelle Bowman said generative and agentic AI should be governed by other risk management and governance practices. She also named the questions supervisors use to understand a use case:
- Is it material? Will it be used for material tasks?
- How broad is access? Is it available to all employees or limited?
- Does it touch customers? Does it directly affect consumers, as with credit decisions?
Those three questions are the simplest way to tier your own use cases. And because most genAI comes from a vendor, the interagency guidance on third-party relationships (OCC Bulletin 2023-17) does a lot of the work: due diligence before you sign, contract terms, and ongoing monitoring.
What is the CSBS AI Supervisory Framework?
On September 16, 2026, the Conference of State Bank Supervisors released an AI supervisory framework for state examiners. It's a discretionary tool, and each state regulator decides how much of it to adopt. It includes:
- A core examiner guide with scoping questions, a document request list, and review procedures for governance, AI inventories and use cases, and generative AI.
- An examiner work program with more detail on applying the guide.
- An optional risk-tiering worksheet that institutions can also use to assess their own use cases.
It builds on NIST's AI Risk Management Framework, the Cyber Risk Institute's financial services AI framework and the Treasury's AI lexicon. If your bank is state-chartered, ask your state regulator whether and how it plans to use it. Either way, the document request list is a good preview of what an examiner may ask for.
Credit unions have a parallel answer: the NCUA says it has no AI-specific rules, that existing regulations are technology-neutral, and that examiners review internal controls around AI tools and third-party due diligence.
What should a community bank do now?
Six steps worth taking now, whatever the coming RFI brings:
- Build an AI inventory. Every tool and use case, including AI features your current vendors have switched on inside core, CRM or document systems.
- Tier each use case with Bowman's three questions: material, broadly accessible, customer-facing.
- Write or update the AI policy so it stops citing SR 11-7 for genAI and points to your risk management and third-party programs instead.
- Run vendor due diligence on each AI provider under your third-party program, including who the model provider behind the vendor is.
- Use enterprise accounts only. No personal accounts for work, ever. Pick a plan with audit logs and retention you control, so monitoring is possible.
- Report to the board with the inventory and the tiering, so oversight is documented, not assumed.
An honest caveat: this is guidance in motion. The model risk guidance itself says non-compliance won't draw supervisory criticism, the RFI hasn't been issued yet, and the CSBS framework is voluntary for states. None of that changes safety and soundness, third-party risk or consumer protection obligations. Document your reasoning now, and you'll be able to adjust when the next guidance lands.
How do we handle it at Andes?
Our AI governance package delivers the AI policy, the use case inventory, the risk assessment mapped to your regulator's framework and your parent group's standard, vendor due diligence templates and staff training. If you're still choosing the tool, see whether you need Claude Team or Claude Enterprise, and if you don't yet know what's in use, start with how to control shadow AI.
Does your AI policy still cite SR 11-7?
If it does, that's the first update. See our AI for regulated institutions service and let's build the inventory before an examiner asks for it.
Sources
- OCC Bulletin 2026-13, Model Risk Management: Revised Guidance (April 17, 2026): https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-13.html
- Federal Reserve, SR 26-2 (April 17, 2026): https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm
- Federal Reserve, Michelle W. Bowman, Artificial Intelligence in the Financial System (published May 1, 2026): https://www.federalreserve.gov/newsevents/speech/bowman20260501a.htm
- CSBS, Artificial Intelligence Supervisory Framework (September 16, 2026): https://www.csbs.org/csbs-artificial-intelligence-supervisory-framework
- OCC Bulletin 2023-17, Third-Party Relationships: Interagency Guidance on Risk Management: https://www.occ.gov/news-issuances/bulletins/2023/bulletin-2023-17.html
- NCUA, Artificial Intelligence (AI): https://ncua.gov/regulation-supervision/regulatory-compliance-resources/artificial-intelligence-ai