Model risk teams reading SR 26-2 keep arriving at the same question: where does our program fall short of it? The guidance does not answer that question for them, by design. Our SR 26-2 gap self-assessment gives a structured way to answer it, in about five minutes.
Why there is no official checklist
The Federal Reserve, the OCC and the FDIC issued SR 26-2 on 17 April 2026, replacing SR 11-7 and SR 21-8. The guidance describes itself plainly: "This guidance does not set forth enforceable standards or prescriptive requirements; accordingly, non-compliance with this guidance will not result in supervisory criticism against a banking organization."
A document with no prescriptive requirements has nothing to tick off. SR 26-2 describes principles for model development, validation, monitoring and governance, and it places the choice of practice with the institution: each banking organization is responsible for adopting practices that are appropriate and effective for the risks it faces. The letter states that the guidance is most relevant to banking organizations with over $30 billion in total assets, and that it may also be relevant to smaller ones with significant model risk.
Two consequences follow for anyone preparing for a review.
- The burden of explanation moves to the institution. With no list of required steps, a program is judged on whether its practices fit its model risk, and on whether the institution can show that they do.
- Supervisory exposure has not gone away. A footnote to the guidance states that supervisory action may still result from violations of law or unsafe or unsound practices stemming from insufficient management of model risk.
What a review turns on without a checklist
When the standard is a set of principles, the evidence is the institution's own records. For each area of the guidance, the question becomes whether the practice exists, whether it is written down, and whether records show it is followed:
- an inventory that records which systems meet the revised model definition, and why the others do not;
- a materiality assessment for each model, based on its exposure and purpose, that sets how much oversight it gets;
- validation records covering conceptual soundness and outcomes, and a record of effective challenge: what was questioned and how it was resolved;
- monitoring plans with thresholds, and a record of what happened when a model breached them;
- vendor models on the same inventory, with the evidence used to validate them;
- documentation that tracks findings, responses and exceptions to closure.
Generative and agentic AI still need an answer
Footnote 3 reads:
"Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance. Nonetheless, a banking organization's risk management and governance practices should guide the determination of appropriate governance and controls for any tools, processes, or systems not covered in this document. However, the principles described in this guidance apply to traditional statistical and quantitative models and non-generative, non-agentic AI models."
OCC Bulletin 2026-13, issued the same day, records the same carve-out.
Three questions are worth answering in writing:
- Which of our AI systems are generative or agentic, and which are non-generative models that stay under SR 26-2?
- What governance approach covers the systems outside it, and what records show its controls operate?
- Are AI services bought from vendors managed under third-party risk management? The interagency guidance on third-party relationships (SR 23-4, June 2023) is relevant to all third-party relationships, and SR 26-2 does not supersede it.
Our reference on the generative AI carve-out covers the footnote in more depth.
What the self-assessment covers
The SR 26-2 gap self-assessment has 18 statements in eight areas:
Each statement is rated on one scale: Not in place, Ad hoc, Documented, or Evidenced. Documented means written down with no records showing it is followed; Evidenced means records exist. Each statement names the section of the SR 26-2 attachment it comes from, so a reviewer can check the source.
Each area is rated by its weakest answer, because a program is only as defensible as its weakest practice. The results show, for every area, the gap behind that answer and one action that closes it. Scoring runs in your browser, and nothing is sent unless you ask for an email copy of the results.
What a score means
The score describes your own answers against the practices SR 26-2 describes. Its use is to show where the records are thinnest, so the next quarter's work goes there first.
Take the SR 26-2 gap self-assessment.
This post summarizes publicly available supervisory guidance and is not legal advice. Verify against the primary sources: the SR 26-2 letter, its attachment and OCC Bulletin 2026-13.