Framework · Model risk
SR 26-2, applied to the models you actually run.
Since April 2026, SR 26-2 has defined how U.S. banking organizations inventory, monitor, document, and govern their models. It asks firms to defend their approach rather than follow a checklist, and Meilynx produces the evidence that defense needs.
Principles over procedure.
The Federal Reserve, OCC, and FDIC issued SR 26-2 jointly on 17 April 2026, superseding the 2011 guidance. The three validation components, effective challenge, and documentation for independent review are unchanged; the burden moved from following a fixed process to defending an appropriate one.
What SR 26-2 changed
- The fixed annual revalidation cycle gives way to a risk-based cadence tied to materiality, change velocity, and data availability.
- A narrower model definition. Simple spreadsheets and deterministic rule engines fall out of scope.
- Generative and agentic AI sit outside the formal scope, with institutions directed to govern them under existing risk-management principles anyway.
- Proportionality is explicit. The letter is most relevant to banking organizations over $30 billion in total assets.
Inventory, monitor, document, govern.
A firm should know which models it runs, watch how they behave, document them well enough for independent review, and govern their use with real controls.
- A complete, current model inventory.
- Ongoing monitoring of how models are used and how they perform.
- Documentation sufficient for an independent validator to review.
- Governance and controls over model access and use, with effective challenge.
Each expectation, to a control.
A specific Meilynx control for each expectation and the artifact it produces.
SR 26-2 → Meilynx controls
| Requirement | How Meilynx maps | Examination artifact |
|---|---|---|
Maintain a complete inventory of models in use SR 26-2 · Governance | The model inventory is populated from live proxy traffic: every model, version, and the team calling it. A model in use cannot be missing from the list. | Model inventory, generated from traffic |
Ongoing monitoring of model use and performance SR 26-2 · Ongoing monitoring | The proxy records model, tokens, cost, latency, and governance findings on every call and surfaces anomalies as they appear. | Monitoring telemetry and findings log |
Controls and policy over model usage SR 26-2 · Governance and controls | Policy-as-code decides which models each team may use, enforced inline with role-based access, and readable by the people who own the control. | Policy snapshot and access matrix |
Documentation sufficient for independent review SR 26-2 · Documentation | A hash-chained, tamper-evident record of each AI response the proxy delivers and each request it blocks, with its governance decision attached, gives an independent validator or examiner durable documentation to review. | Examination-ready audit trail |
Effective challenge and change tracking SR 26-2 · Effective challenge | Versioned policy and an immutable record of what changed, when, and what it affected support the effective-challenge expectation around model controls. | Versioned policy history |
Maintain a complete inventory of models in use
SR 26-2 · Governance
Maps to · The model inventory is populated from live proxy traffic: every model, version, and the team calling it. A model in use cannot be missing from the list.
Examination artifact · Model inventory, generated from traffic
Ongoing monitoring of model use and performance
SR 26-2 · Ongoing monitoring
Maps to · The proxy records model, tokens, cost, latency, and governance findings on every call and surfaces anomalies as they appear.
Examination artifact · Monitoring telemetry and findings log
Controls and policy over model usage
SR 26-2 · Governance and controls
Maps to · Policy-as-code decides which models each team may use, enforced inline with role-based access, and readable by the people who own the control.
Examination artifact · Policy snapshot and access matrix
Documentation sufficient for independent review
SR 26-2 · Documentation
Maps to · A hash-chained, tamper-evident record of each AI response the proxy delivers and each request it blocks, with its governance decision attached, gives an independent validator or examiner durable documentation to review.
Examination artifact · Examination-ready audit trail
Effective challenge and change tracking
SR 26-2 · Effective challenge
Maps to · Versioned policy and an immutable record of what changed, when, and what it affected support the effective-challenge expectation around model controls.
Examination artifact · Versioned policy history
The FS AI RMF, subcategory by subcategory.
The package maps the Financial Services AI Risk Management Framework, released by the U.S. Treasury in February 2026, onto its controls. Each of the 72 subcategories (230 control objectives) is classified by where its evidence comes from, alongside the live state of the controls behind it.
72 subcategories, classified
- 21
Proxy-verified
Runtime evidence from governed AI traffic: the model inventory, monitoring, model version changes, the policy in force, and the audit trail.
- 41
Attested elsewhere
Evidenced by the institution's own program, with an attestation recorded in the package where it carries a matching control.
- 10
Out of scope
No bearing on AI traffic, such as team composition, human-subject research, and the environmental impact of model training.
The FS AI RMF is voluntary. The crosswalk shows where each subcategory's evidence sits.
What you hand to a validator.
The audit trail renders into a package built around the model risk reflex: a model inventory drawn from live traffic, the controls in force, and a tamper-evident record an independent reviewer can verify.
In the package
- Model inventory, populated from traffic.
- Control coverage across the monitoring period.
- Versioned governance policy snapshot.
- SHA-256 integrity hash over the audit chain.
- FS AI RMF crosswalk across all 72 subcategories.
Model risk guidance and AI.
What is SR 26-2?
SR 26-2, Revised Guidance on Model Risk Management, was issued jointly by the Federal Reserve, OCC, and FDIC on 17 April 2026. It replaced SR 11-7 and SR 21-8 after fifteen years. The three validation components, effective challenge, and documentation sufficient for independent review all carried forward. The fixed annual revalidation cycle gave way to a risk-based cadence, and the definition of a model narrowed.
Are LLMs in scope for the model risk guidance?
SR 26-2 places generative and agentic AI outside its formal scope and directs institutions to govern them anyway, using existing risk-management principles: materiality, ongoing monitoring, and effective challenge. In practice an examiner still expects a written governance approach for LLM use, a current inventory, monitoring evidence, and a rationale you can defend. Meilynx produces the inventory, monitoring, and documentation evidence that approach requires.
Does the package cover the FS AI RMF?
The SR 26-2 package includes a crosswalk of the Financial Services AI Risk Management Framework, released by the U.S. Treasury in February 2026 and developed by the Cyber Risk Institute with the FSSCC. Each of its 72 subcategories is classified by where its evidence comes from: 21 carry runtime evidence from governed AI traffic, 41 are evidenced by the institution's own program, and 10 have no bearing on AI traffic. The framework is voluntary.
How does the model inventory stay current?
Meilynx sits inline in the request path, so every model call is observed as it happens. The inventory is derived from real traffic, which closes the gap manual inventories leave.
Build the evidence.
See exactly what an examiner receives
Request a sample examination package: model inventory, control coverage, a governance policy snapshot, and a SHA-256 integrity hash.