What changed in April 2026#
On 17 April 2026 the US federal banking agencies issued revised interagency guidance on model risk management — published by the Federal Reserve as SR 26-2, by the OCC as Bulletin 2026-13 and by the FDIC as FIL-15-2026. It replaced most of SR 11-7 and its OCC counterpart, Bulletin 2011-12, which had been issued on 4 April 2011.
Three features of the new guidance matter for LLMs:
- A materiality-based, principles-based approach. Banks scale governance to the risk a model poses rather than applying uniform validation to everything in the inventory.
- A narrower definition of “model.”
- Generative and agentic AI are out of scope. The guidance describes them as novel and rapidly evolving and leaves them for later work, with an interagency request for information on AI model risk announced alongside it.
This page summarizes public guidance as we understand it in October 2026 to help technical and risk teams plan. Confirm obligations with your counsel and compliance function.
The gap this leaves, and how banks are filling it#
Out of scope is not the same as unregulated. Safety-and-soundness expectations, fair-lending law, third-party risk management and consumer-protection rules all still apply to decisions an LLM influences. What disappeared is a ready-made template. In our engagements, banks are filling the gap in one of two ways:
- Extend the existing model-risk framework to LLMs by internal policy. The SR 11-7 vocabulary — conceptual soundness, ongoing monitoring, outcomes analysis, effective challenge — is familiar to validators and examiners, and it maps well onto a fine-tuned model with a narrow task.
- Stand up a separate AI governance process owned jointly by model risk, compliance and technology, with lighter validation for low-materiality uses and full validation for anything touching credit, financial crime or customers.
Either way, a fine-tuned model is easier to bring into governance than a prompted frontier API, because it has the properties validators look for: a fixed version, documented training data, a defined task and a measurable error rate.
Mapping a fine-tuning engagement to validation evidence#
| Validation question | Evidence from a fine-tuning engagement |
|---|---|
| Is the approach conceptually sound for this use? | Design memo: task definition, why fine-tuning over prompting or retrieval, base-model selection bake-off, data card |
| Does the data represent the population it will see? | Data lineage, sampling frame, segment coverage report, contamination check against the test set |
| How well does it perform, and where does it fail? | Frozen, adjudicated held-out set; metrics with confidence intervals; per-segment results; worst-segment reporting |
| Is performance stable and monitored? | Online evaluation on sampled production traffic, drift thresholds, retraining policy with release gates |
| Has it been effectively challenged? | Independent re-run of the evaluation by the bank’s validators, red-team log, blind human review against the incumbent process |
| Is the vendor relationship controlled? | Weights, code and evaluation harness owned by the bank; no runtime dependency on the vendor |
Two statistical points we see validators press on. Sample sizes must support the claims made, segment by segment (our power analysis). And if an LLM judge produces any of the metrics, its error rates must be measured and corrected for, because an imperfect judge shrinks real differences and can reverse a ranking (judge bias correction).
Tiering LLM uses by materiality#
| Tier | Example uses | Typical governance |
|---|---|---|
| High | Credit decisions, fraud and AML disposition, customer-facing advice | Full validation, independent testing, human review of adverse outcomes, quarterly monitoring report |
| Medium | Analyst drafting tools, document extraction feeding human review | Targeted validation of the task metric, monitoring, annual review |
| Low | Internal search, summarization for employees | Registration in the inventory, basic testing, usage monitoring |
A fine-tuned adverse-media screening model that dispositions alerts (a case on our results page) sits in the high tier; the same base model fine-tuned to summarize internal policy documents sits in the low tier.
What we do differently for banks#
- Train and serve inside the bank’s environment; no data or weights leave it.
- Agree the evaluation design with the validation team before training, not after.
- Keep a held-out set the development team never sees, for the validator’s use.
- Deliver documentation in the bank’s own model-documentation template.
- Version everything — data, code, configs, weights — so the validator can reproduce the result.
References#
- Board of Governors of the Federal Reserve System and OCC (2011). SR 11-7: Supervisory Guidance on Model Risk Management.
- Office of the Comptroller of the Currency (2026). OCC Bulletin 2026-13: Model Risk Management — Revised Interagency Guidance.