Regulatory Reference.

What SR 26-2 requires, how it differs from SR 11-7, why generative and agentic AI sit outside it, and where supervisors still act. Fed, OCC, FDIC, April 2026.

Last reviewed October 11, 2026

The differences between SR 11-7 and SR 26-2, what carried forward unchanged, and what model risk programs need to update.

Last reviewed October 11, 2026

SR 26-2 places generative and agentic AI outside the model risk guidance in one footnote. What that means for AI agents and MCP tools, what still applies, and the evidence banks keep.

Last reviewed October 23, 2026

What OCC Bulletin 2026-13, Model Risk Management: Revised Guidance, applies to, the four OCC issuances it rescinds, how it relates to SR 26-2, and the AI request for information still to come.

Last reviewed October 9, 2026

What PRA SS1/23 expects of UK banks with internal model approval, how its model definition reaches LLMs and vendor models, and what the April 2026 update changed.

Last reviewed October 15, 2026

The questions a bank asks an AI vendor under the interagency third-party guidance and SR 26-2, and the evidence that answers each one.

Last reviewed October 11, 2026

What ECOA and Regulation B require of an adverse action notice when AI drives a credit decision, after the CFPB withdrew its AI circulars in 2025 and removed disparate impact from Regulation B in 2026.

Last reviewed November 4, 2026

What NYDFS Section 500.13 requires for asset inventory and secure disposal of nonpublic information, who it binds, and what examiners expect to see.

Last reviewed October 11, 2026

What the NYDFS advisory of 21 May 2026 on frontier AI models asks of regulated entities, its companion guidance, and how it sits within Part 500.

Last reviewed October 11, 2026

How the NIST SP 800-53 Rev. 5 control families apply to the calls a system makes to AI models and tools, where NIST's AI overlays and FedRAMP 20x stand, and the FIPS 140-3 date.

Last reviewed October 7, 2026

The supervision, recordkeeping, and communications obligations that attach when member firms use generative AI and LLMs, and what examiners expect to see.

Last reviewed October 11, 2026

FINRA's 2026 Oversight Report on generative AI and AI agents: the rules it cites, the practices it describes, and the records a member firm keeps.

Last reviewed November 4, 2026

Which AI outputs, prompts, notetaker transcripts and agent actions become books and records under SEA Rule 17a-4 and Advisers Act Rule 204-2, how long each is kept, and in what form.

Last reviewed October 9, 2026

What the NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers expects, which states have adopted it, and what a market-conduct examiner asks for.

Last reviewed October 11, 2026

What Colorado Regulation 10-1-1 (3 CCR 702-10) requires of life, auto, and health insurers using external consumer data, with the 2025 amendment dates.

Last reviewed October 11, 2026

What the NAIC AI Systems Evaluation Tool, now the AI Risk Evaluation Supplement, asks insurers, where its 2026 pilot and adoption stand, and the records to have ready.

Last reviewed October 11, 2026

What Illinois HB 3773, New York City Local Law 144, and Colorado SB 26-189 require of employers using AI in hiring and promotion, with dates, obligations, and common gaps.

Last reviewed October 11, 2026

What Illinois HB 3773 (Public Act 103-0804) requires of employers using AI: the discriminatory-effect and zip-code bans, the notice duty, the status of the notice rules, and how charges are enforced.

Last reviewed November 4, 2026

Which EU AI Act obligations apply now, which the Digital Omnibus (Regulation (EU) 2026/1744) deferred, and the deployer duties behind each date.

Last reviewed October 11, 2026

What DORA has required of EU financial entities since 17 January 2025, and how its ICT risk, incident, and third-party obligations reach an AI workload.

Last reviewed October 11, 2026

What Article 12 of the EU AI Act requires high-risk AI systems to log, who keeps the logs and for how long, and when the duty applies after the Digital Omnibus.

Last reviewed October 11, 2026

What the HIPAA Security Rule requires when covered entities and business associates route electronic PHI through AI tools: business associate agreements, risk analysis, audit controls, minimum necessary, breach notification, and the pending update.

Last reviewed October 11, 2026

What 45 CFR 92.210 requires of covered entities that use clinical algorithms and AI: identify tools with protected-class inputs, mitigate the risk of discrimination, and where enforcement stands in 2026.

Last reviewed October 11, 2026

The 31 source attributes and the risk management practices 45 CFR 170.315(b)(11) requires for predictive decision support, what deploying organizations should ask their developer for, and where HTI-5 stands.

Last reviewed October 11, 2026

What Texas SB 1188 and HB 149, California AB 3030, SB 1120 and AB 489, Colorado HB 26-1139 and SB 26-189, Maryland HB 820 and Arizona HB 2175 require of providers and payers using AI, how Illinois, Nevada and Utah limit AI in therapy, and the Joint Commission and CHAI guidance.

Last reviewed November 4, 2026

What FDA's final predetermined change control plan guidance (December 2024) and draft lifecycle guidance (January 2025) recommend for AI-enabled device software functions, and what a deploying organization can prepare.

Last reviewed October 15, 2026