Does SR 26-2 apply to community banks — and to generative AI?

In April 2026 the Federal Reserve, OCC, and FDIC replaced the model risk guidance that had shaped bank practice for fifteen years. SR 26-2 superseded SR 11-7, the original 2011 guidance, and SR 21-8, the 2021 statement on BSA/AML models. For community bankers, two questions follow immediately: is this aimed at us, and does it cover the AI tools our people are actually using?

Who SR 26-2 is aimed at

The Federal Reserve's letter is direct about it: SR 26-2 is expected to be most relevant to banking organizations with over $30 billion in total assets that the Fed regulates. It also says model risk management practices should vary with each institution's risk profile and how it uses models.

The interagency guidance itself goes further: it says generally excluding banks with $30 billion or less in total assets is consistent with a tailored supervisory approach, though it may still be relevant to a smaller bank with significant model risk exposure.

That is not a license to stop managing models. A community bank that uses models for credit scoring, pricing, CECL allowance estimates, interest rate risk, or BSA/AML monitoring still needs to understand them, know their limits, and keep evidence that someone checked. What SR 26-2 signals is proportion: your program should fit the number and importance of your models, not mirror a regional bank's.

Why generative AI sits outside its formal scope

SR 26-2 is non-binding, and it says generative and agentic AI models are novel and rapidly evolving and are not within its scope. The agencies have said they plan to request public information on AI, including generative and agentic AI. It also says an institution's own risk management and governance should guide the controls for tools it does not cover. So the guidance most people expected to answer "how do we govern ChatGPT-style tools" deliberately does not.

Do not read that as a gap you can wait out. GAO's 2025 review found that regulators primarily oversee AI through existing laws, regulations, guidance, and risk-based examinations. Generative AI used at your institution still runs into your information security program, privacy obligations, third-party risk management, fair lending and UDAAP expectations, and records requirements. And state examiners now have the CSBS AI Supervisory Framework, which treats generative AI as its own review area.

What to do with this

Sort your AI into two lists. Your AI use case inventory should separate traditional models — the ones SR 26-2 contemplates — from generative AI tools used for drafting, summarizing, and search. The first list gets model risk treatment scaled to your size. The second gets governance through your AI acceptable use policy, data rules, vendor diligence, and human review.

Right-size the model list. For each traditional model: an owner, a description of what it does and its known limits, the last time someone checked its performance, and what you would do if it failed. For vendor models, the vendor's validation evidence plus your own outcomes monitoring.

Give generative AI its own page. A short section of your AI policy, or a standalone procedure, covering approved tools, the data line, and who reviews output. That page is what an examiner looking at generative AI is likely to ask for — and SR 26-2 will not have written it for you.

Retire the SR 11-7 references. Policies and procedures that still cite SR 11-7 as current guidance should be updated to reflect that SR 26-2 superseded it. It is a small fix that signals your program is current.