1 · The 2026 regulatory map
No U.S. regulator has published a comprehensive AI rulebook for financial services, and none is imminent. Firms face instead a lattice of older, technology-neutral instruments that reach AI without a word being amended. The firms that struggle in examinations are rarely the ones that broke a new rule; they are the ones that assumed the old rules needed AI named in them before they applied.
Four families of instruments do most of the work: the revised interagency model risk guidance (SR 26-2, with its OCC companion Bulletin 2026-13), FINRA Regulatory Notice 24-09, the NYDFS cybersecurity regulation (23 NYCRR Part 500), and the books-and-records baseline (SEA Rule 17a-4 with FINRA Rule 4511 for broker-dealers, Rule 204-2 under the Advisers Act for investment advisers). Here is how they arrived:
Apr 2011
SR 11-7 issued
The Federal Reserve's model risk management guidance; the OCC adopts it as Bulletin 2011-12. It shapes bank model governance for fifteen years.
Mar 2017
NYDFS Part 500 adopted
New York's cybersecurity regulation binds covered financial institutions, including the data-retention duties that now reach AI systems.
Nov 2023
Part 500 Second Amendment
Adds the asset-inventory obligation to Section 500.13, turning a disposal-only section into inventory plus disposal.
Jun 2024
FINRA Notice 24-09
FINRA reminds member firms that supervision, communications, recordkeeping, and vendor-oversight rules apply to generative AI as to any other technology.
Nov 2025
500.13(a) in force
The NYDFS asset-inventory requirements take effect. AI systems handling nonpublic information belong on the inventory, fields populated.
Apr 2026
SR 26-2 + OCC 2026-13
The Fed, OCC, and FDIC jointly replace SR 11-7 and place generative and agentic AI outside its scope. All of the obligations above still apply.