Reference · Model risk management

SR 26-2 and Generative and Agentic AI: The Carve-Out Explained

Footnote 3 of the Revised Guidance on Model Risk Management, and what reaches AI agents instead

Last reviewed October 23, 2026

SR 26-2, the model risk guidance the Federal Reserve, the OCC and the FDIC issued on 17 April 2026, leaves generative and agentic AI out in its third footnote: "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance."Revised Guidance · footnote 3

The footnote takes these systems out of one piece of guidance. Third-party risk management guidance, information security standards, consumer credit and securities rules, and the institution's own risk management still reach an AI agent and the tools it calls, including tools connected over the Model Context Protocol (MCP).

The footnote makes three statements

Footnote 3 is attached to the definition of a model in Section II. After placing generative and agentic AI models out of scope, it says a banking organization's risk management and governance practices should guide the governance and controls for any tools, processes or systems the guidance does not cover. Its last sentence keeps the guidance's principles in force for traditional statistical and quantitative models and for non-generative, non-agentic AI models.Revised Guidance · footnote 3 The OCC's bulletin repeats the carve-out in its own summary of the guidance.OCC Bulletin 2026-13 · Highlights

The guidance does not define generative AI or agentic AI.Revised Guidance FINRA's working description of an AI agent is a system that can autonomously perform and complete tasks on a user's behalf, planning, deciding and acting toward a goal without predefined rules.FINRA 2026 Report, GenAI · Agents The FINRA 2026 report entry covers what FINRA expects of firms that use agents.

Supervisors asked banks about AI agents in October without issuing guidance

Reuters reported on 13 October 2026 that the Federal Reserve, the OCC and the FDIC were questioning large, mid-size and smaller banks about their use of advanced AI, in writing and in conversation. According to six people familiar with the matter, the questions covered the use of Chinese-developed technology, the use of AI agents in cyber defense, the limits placed on agentic systems and how their actions are monitored and approved, whether agent decisions can be tracked and audited, the safeguards that stop an agent from exceeding its authority, human involvement in key decisions, and how an autonomous system would be shut down. All three agencies declined to comment.Reuters, 13 October 2026 The questions are supervisory inquiries described in a press report, and no agency has published them.

The OCC's bulletin says the agencies plan to issue "in the near future" a request for information on model risk management that considers banks' use of AI, including generative AI, agentic AI and AI-based models.OCC Bulletin 2026-13 As of 23 October 2026 no such request has appeared in the Federal Register, and the Federal Reserve's press releases for September and October include none.Federal Register Fed press releases 2026 The Federal Reserve's SR letters, the OCC's bulletins and the FDIC's financial institution letters issued since 17 April include no further guidance on generative or agentic AI.SR letters 2026 OCC bulletins 2026 FDIC FILs

Federal Reserve Vice Chair for Supervision Michelle Bowman, in remarks delivered on 27 April 2026 that she gave as her own views, said the revised guidance "now applies narrowly to traditional models and basic AI applications." She said other risk-management and governance practices are expected to support the adoption of generative and agentic AI.Bowman, 27 April 2026

Each supervisory question maps to a record the bank can produce

Each question in the Reuters report asks the bank to show a control over its agents.Reuters, 13 October 2026 The Financial Stability Board's June consultation describes several of the matching records as current practice at financial institutions: agent inventories that list each agent's tools and guardrails, human approval at checkpoints, and records of each agent's steps and tool access.FSB consultation · pp. 23, 43, 44

Question as reported	Record that answers it
Use of Chinese-developed technology	An inventory of the models and agents in use, including those inside vendor products, with the provider and origin of each model
AI agents in cyber defense	The inventory entry for each security agent: its owner, its purpose, and the tools and systems it can reach
Limits on agentic systems	The policy in force for each agent at the time of each action, with the tools, data and systems it may use, the actions it may not take, and a change history
How agent actions are monitored and approved	A log of each agent action and tool call, and an approval record for each action that required one
Whether agent decisions can be tracked and audited	A sealed decision log an independent reviewer can verify, tying each action to the agent and the policy applied
Safeguards against exceeding authority	An agent inventory tied to a verified credential for each agent, and a record of each action the policy blocked or held
Human involvement in key decisions	The approval or hold record for each consequential action, naming the accountable person and the time of the decision
How an autonomous system is shut down	The record of an agent's access being revoked, with who revoked it and when

Questions as reported by Reuters on 13 October 2026; the agencies declined to comment. The record for each question is our mapping. Reuters via Insurance Journal

These questions test controls the institution owns under its own risk management, which is where footnote 3 sends generative and agentic systems.Revised Guidance · footnote 3

For an agent, scope is decided one component at a time

An agent built on a large language model plans steps and acts on them, often by calling tools. The Model Context Protocol is an open protocol for connecting AI applications to external data sources and tools, and an MCP server can expose tools, which the specification describes as functions for the AI model to execute.MCP specification

The language model that plans, and the agent as a whole, are generative and agentic AI and fall outside SR 26-2. A traditional or non-generative AI model the agent calls through a tool, such as a credit score or a fraud model, stays in scope, because footnote 3 keeps those models under the guidance.Revised Guidance · footnote 3 One workflow can hold components on both sides, and each needs its own scoping decision.

The protocol leaves the controls to the institution. Its specification says tools represent arbitrary code execution, and that MCP cannot enforce its security principles at the protocol level, so consent, authorization and access controls fall to the applications that implement it.MCP specification · Security and Trust & Safety

Flow

One agent task, and what reaches each step

TaskAgent receives a requestFrom a user, an application or another agent
Footnote 3Language model plans the stepsOutside SR 26-2; the institution's own governance applies
In scopeAgent calls a credit modelTraditional and non-generative AI models stay under SR 26-2
Third partyAgent calls a vendor tool over MCPThird-party risk management covers the relationship
Customer dataTool returns customer recordsInformation security standards govern the program around them
OutcomeApplication is declinedRegulation B requires the specific principal reasons

Scope from footnote 3 of the Revised Guidance; the later steps cite the 2023 third-party guidance, the information security standards and Regulation B. The workflow and its order are an illustration of ours.

Third-party, security, consumer and securities rules still reach agents

Third-party risk management. The agencies' 2023 guidance covers any business arrangement between a banking organization and another entity, by contract or otherwise, and a relationship can exist without a contract or payment.2023 third-party guidance · p. 2 Using a third party does not diminish the organization's responsibility to operate safely and soundly and in compliance with the law, to the same extent as if the activity were performed in-house.2023 third-party guidance · p. 1 On that test, a model provider, an agent platform and the operator of a remote MCP server are each a third-party relationship.
The September 2026 proposal. The agencies proposed guidance on 11 September 2026 that would replace the 2023 guidance.OCC NR 2026-77 It was published in the Federal Register on 15 September, and comments close on 16 November 2026. It keeps the principle that a third party does not diminish the organization's responsibility, says a third party's use of subcontractors does not typically create a separate third-party relationship, and leaves the organization responsible for compliance whatever subcontractors the third party uses.91 FR 58536 · pp. 58539, 58543 The model provider behind a vendor's agent typically sits in that subcontractor position, and what a bank's third-party review asks an AI vendor covers how banks ask about it.
Information security. The Interagency Guidelines Establishing Information Security Standards require a program that controls risks to customer information, with access controls and intrusion monitoring among the measures to consider, and require service providers to be selected with due diligence and bound by contract to protect that information.12 CFR 30, App. B · III.C, III.D An agent that reads customer records through a tool works inside that program.
Credit decisions. Regulation B requires a statement of the specific principal reasons for adverse action; saying the applicant failed the creditor's internal standards or did not reach a qualifying score is insufficient.12 CFR 1002.9 · 1002.9(b)(2) The rule makes no exception for the system that made the decision, as the Regulation B adverse action entry explains.
Supervision and recordkeeping in a broker-dealer affiliate. FINRA states that its rules and the securities laws continue to apply when firms use generative AI, including Rule 3110's requirement of a reasonably designed supervisory system tailored to the business.FINRA 2026 Report, GenAI · Regulatory Obligations SEC Rule 17a-4 requires broker-dealers to preserve communications relating to the business as such, whoever or whatever drafted them.Rule 17a-4 · (b)(4)
Safety and soundness. SR 26-2 itself notes that supervisory action may result from violations of law or unsafe or unsound practices.Revised Guidance · footnote 1 For institutions the OCC and the FDIC supervise, a final rule effective 2 November 2026 limits matters requiring attention to practices that could reasonably be expected to materially harm the institution's financial condition, and to actual violations of banking or banking-related law.91 FR 56004 · 12 CFR 4.92(c), 305.1(c)

These rules reach an agent through what it touches: the vendor that supplies it, the customer data it reads, the decision it informs and the communication it sends.

Voluntary frameworks give the approach a structure

The NIST AI Risk Management Framework, released on 26 January 2023, is intended for voluntary use, and NIST says AI RMF 1.0 is being revised.NIST AI RMF Its Generative AI Profile (NIST AI 600-1, 26 July 2024) names twelve risks of generative AI, among them confabulation, information security, and value chain and component integration, and lists suggested actions against the framework's functions.NIST AI 600-1 · Section 2 One of those actions is to assess security threats that include autonomous agents.NIST AI 600-1 · MS-2.7-001 For agents specifically, NIST launched an AI Agent Standards Initiative on 17 February 2026, with research on agent security and identity among its three pillars.NIST, AI agents

The Financial Services AI Risk Management Framework (FS AI RMF), released by the U.S. Treasury on 19 February 2026 and developed by the Cyber Risk Institute with the Financial Services Sector Coordinating Council, adapts the NIST framework to financial services.Treasury It sets out 230 control objectives organized by stage of AI adoption.Cyber Risk Institute

None of these frameworks is binding, and none creates a safe harbor. Mapping a program to one gives an examiner a recognized structure to test it against.

The evidence banks already keep for agents

The Financial Stability Board's consultation report on sound practices for AI adoption, published on 10 June 2026, describes what financial institutions are doing now.FSB consultation For agents, its examples are specific:

Inventory entries for each agent with an identifier, the tools the agent can access, its components and its guardrails. Some banks track permitted uses and known risks per agent, and more mature ones certify an agent for use within defined boundaries and record that status in the inventory.FSB consultation · p. 23
Enhanced documentation and logging, including prompt versioning and version control so a configuration can be rolled back, with contractual arrangements where a vendor controls those settings.FSB consultation · p. 23
Boundaries on each agent: actions that are prohibited or need human approval at checkpoints, and limits on what it can reach, including APIs, data, systems and other agents.FSB consultation · p. 43
For agents that move money: human approval or dual authorization above a set value, no direct access to payment systems, and audit trails of agent transactions.FSB consultation · p. 43
Records of each agent's intermediate steps and tool access, watched for scope creep such as querying more databases or customer records than the task needs.FSB consultation · p. 44
Least privilege for agents and their sub-agents.FSB consultation · p. 45
Analysis of the oversight itself, looking for reviewers who approve agent recommendations without change.FSB consultation · p. 43

FINRA's 2026 report describes the same kinds of records for broker-dealers: prompt and output logs, which model version was used and when, human review of outputs and, for agents, monitoring of system access and data handling and tracking of agent actions and decisions.FINRA 2026 Report, GenAI · Current Practices, Agents

A written approach is what the institution can defend

Footnote 3 leaves the governance of these systems to the institution's own practices.Revised Guidance · footnote 3 The principles SR 26-2 applies to models in scope (materiality, ongoing monitoring, effective challenge, and documentation sufficient for review) give that approach a starting point. A defensible approach for agents contains:

A written governance approach for generative and agentic systems, approved and dated, with the reasons it fits their risk.
An inventory of those systems, including AI inside vendor products, with each agent's tools and limits.
Oversight scaled to materiality: what the system decides, drafts or does, and who acts on the result.
Monitoring in production, including changes the provider makes to a hosted model.
Controls on the customer and confidential data that reaches a model or a tool.
Human approval of consequential actions before they take effect, with a record of each approval.
Records sufficient for an independent reviewer to reconstruct what an agent did, with which tools, and why.

Control mapping

What a reviewer expects to be able to see.

Obligation	What the system must do	Evidence a reviewer expects
Written approach	Document how generative and agentic systems are governed, and why the approach fits their risk	The approved approach, its rationale and review dates
Inventory	Know every generative and agentic system in use, including those inside vendor products	Inventory with owner, purpose, provider and materiality
Agent tools and limits	Record the tools, data and systems each agent can reach, and the actions it may not take	Per-agent tool list, permitted scope and guardrails, with change history
Materiality	Scale oversight to what the system decides or does and who relies on it	Tiering rationale per system
Monitoring	Watch behavior in production, including provider model changes	Monitoring records and model version history
Data controls	Control the customer and confidential data that reaches a model or a tool	The enforced policy and a record of what it blocked or redacted
Human approval	Approve consequential agent actions before they take effect	Approval records tied to the action, the agent and the approver
Records	Keep records sufficient for independent review	A tamper-evident record of agent actions, tool calls and governance decisions

Key dates

Timeline, drawn to scale

From the carve-out to the October questions on AI agents

PublishedUpcomingCarve-out and agent questions

Dates from the SR 26-2 letter, Vice Chair Bowman's remarks, the OCC, Reuters and the Federal Register. Status as of October 23, 2026.

26 January 2023NIST publishes the AI Risk Management Framework (AI RMF 1.0).
7 June 2023The Federal Reserve, FDIC and OCC issue the interagency guidance on third-party relationships (SR 23-4).
26 July 2024NIST publishes the Generative AI Profile (NIST AI 600-1).
17 February 2026NIST launches the AI Agent Standards Initiative.
19 February 2026Treasury releases the FS AI RMF and a shared AI lexicon for the financial sector.
17 April 2026SR 26-2 issued, superseding SR 11-7 and SR 21-8. Footnote 3 places generative and agentic AI outside its scope.
27 April 2026Vice Chair for Supervision Bowman says the revised guidance now applies narrowly to traditional models and basic AI applications.
10 June 2026The Financial Stability Board publishes its consultation report on sound practices for AI adoption.
11 September 2026The agencies propose interagency third-party risk management guidance to replace the 2023 guidance.
15 September 2026Proposed interagency third-party risk management guidance published in the Federal Register.
13 October 2026Reuters reports that the Federal Reserve, the OCC and the FDIC are questioning banks about AI agents.
2 November 2026The OCC and FDIC final rule on unsafe or unsound practices and matters requiring attention takes effect.
16 November 2026Comments on the proposed third-party risk management guidance close.

Sources cited

Common gaps

Where institutions most often come up short on systems the guidance leaves out.

Out of scope treated as ungoverned. The footnote sends these systems to the institution's own risk management. An inventory that quietly drops them leaves nothing to show when an examiner asks.
Agents inventoried without their tools. An entry that names the agent and not the tools, data and systems it can reach leaves out what decides its risk. Tool lists change after approval, so the record needs a history.
Vendor-embedded AI missing from the inventory. A generative model inside a purchased product is still in use by the institution, and third-party risk management applies to it.
No record of provider model changes. Hosted models change behind a stable name. Without a version history, monitoring results cannot be tied to the model that produced them.
Hybrid workflows scoped as one system. When an agent calls a statistical model, the model stays under SR 26-2 and the agent does not. Each needs its own scoping decision and its own evidence.
Framework alignment presented as compliance. The FS AI RMF and the NIST AI RMF are voluntary. Describing alignment as compliance overstates the posture to a reviewer who knows the difference.

In practice

How Meilynx maps to SR 26-2, including the FS AI RMF crosswalk →

Last reviewed October 23, 2026. This reference summarises publicly available regulatory guidance and is provided for general information. It is not legal advice. Obligations depend on an institution's charter, registration status, size, and activities. Verify against the primary sources cited above and consult counsel before relying on any summary here.