OCC rescinds SR 11-7 — and generative AI sits outside the replacement's scope

What changed

On April 17, 2026, the OCC, Federal Reserve, and FDIC issued revised interagency guidance on model risk management (OCC Bulletin 2026-13; Federal Reserve SR 26-2). It supersedes SR 11-7 — the model-risk framework banks had leaned on since 2011 — and related issuances, replacing them with a risk-based, principles-driven approach tailored to a bank’s size, complexity, and model-risk profile.

Two details carry the weight:

• Generative and agentic AI are explicitly outside the revised guidance’s scope, described as novel and rapidly evolving.
• The agencies plan a request for information addressing model risk management generally and banks’ use of AI — including generative and agentic AI — in particular.

What it means for you

The formal framework no longer describes the tools your teams use daily. Roughly 41% of workers use generative AI for work (Federal Reserve FEDS Note, April 3, 2026). The guidance your examiners reference now explicitly does not cover that activity.

Out of scope is not exempt. The revised guidance is explicit that broader risk-management and governance practices still apply to tools it doesn’t cover. You remain accountable for generative-AI output without a tailored framework to point at — that gap is the exposure.

The logic survives; the citation doesn’t. The three-lines-of-defense discipline remains the intellectual backbone of model risk. But SR 11-7 is rescinded: policies, model documentation, and vendor materials that cite it as live guidance are now stale. Sweep them.

The defensible posture in the gap: independent validation — the generator never grades its own homework — and a signed, dated record of what was checked, against which standard, by whom. When the RFI lands and the framework catches up, the firms with records will reconcile; the firms without them will reconstruct.