The regulatory landscape for financial institutions shifted in April 2026 with the issuance of SR Letter 26-2, jointly promulgated by the Federal Reserve, the FDIC, and the OCC. The guidance modernizes model risk management (MRM) expectations, superseding SR 11-7 from 2011. It is expected to be most relevant to banking organizations with over $30 billion in total assets, though examiners have historically applied SR 11-7 informally to institutions below that threshold, and the same is likely with SR 26-2. For institutions of any size already investing in AI governance, the framework sets a useful benchmark.
SR 26-2 replaces the binary model/non-model classification with a three-tier structure: traditional statistical and quantitative models, non-model tools (such as spreadsheets and deterministic rules), and a third category for systems that fall outside the guidance's scope. Generative AI and agentic AI fall into that third category. The agencies explicitly state these systems are excluded because they are "novel and rapidly evolving."
That exclusion does not eliminate the governance obligation. The guidance states that an organization's broader risk management and governance practices must still determine appropriate controls for any systems not covered. Financial institutions are expected to govern generative and agentic AI, but SR 26-2 does not provide the specific framework for doing so.
SR 26-2 groups generative and agentic AI together, but the two present distinct governance challenges. Generative AI systems produce outputs (text, code, images) based on prompts. Agentic AI systems take autonomous actions across tools, data sources, and workflows, often with minimal human review at each step. The governance requirements for a system that can execute transactions or initiate processes on behalf of a user are materially different from those for a system that generates a summary document. Any governance framework applied to these systems needs to account for that distinction, including defining permitted actions, mandatory human approval thresholds, activity logging, and exception escalation paths for agentic systems specifically.
SR 26-2 is clear that the GenAI carve-out does not mean no oversight applies. What it means, in practice, is that institutions must identify which other frameworks apply and build controls accordingly. For U.S.-based institutions, the NIST AI Risk Management Framework (AI RMF 1.0) is the primary voluntary standard, and NIST published a Generative AI Profile (NIST AI 600-1) in July 2024 that maps 12 risk categories specific to generative AI back to the core RMF functions. For institutions with European operations or exposure, the EU AI Act imposes specific obligations for general-purpose AI models, with those provisions effective as of August 2, 2025, and high-risk AI system requirements (including financial AI such as credit scoring) effective August 2, 2026.
Without a cross-framework governance structure, institutions building an AI audit trail for examiners have no single standard to point to. SR 26-2 requires "effective challenge" for models in scope. For generative and agentic AI, the same principle of independent, objective review applies under NIST and the EU AI Act, but the methods and documentation differ.
Monitaur operates on a common baseline across global laws, regulations, frameworks, and standards. This includes the EU AI Act, the NIST AI RMF, and state-level algorithmic discrimination laws. By mapping requirements cross-sectionally, Monitaur identifies the requirements that appear across the most frameworks and establishes those as the baseline controls. Because the NIST AI RMF and EU AI Act both address the specific risk categories of generative and general-purpose AI, Monitaur's Common Control Library captures governance requirements for the same systems SR 26-2 excluded. Institutions that align to Monitaur's Common Controls are not building governance for one framework at a time; they are building to a baseline that satisfies the most rigorous requirements across all applicable frameworks.
Identifying the right controls is one challenge. Demonstrating compliance with them is another. SR 26-2 requires effective challenge by independent experts with the organizational standing to enforce changes. For generative and agentic AI, the scarcity of qualified technical reviewers makes that requirement difficult to satisfy through manual processes alone.
Monitaur Automate serves as the automated assurance layer for high-impact AI systems. It translates technical analysis into explainable scorecards for risk, compliance, and board-level review. Automate automatically evidences governance controls aligned to the NIST AI RMF and EU AI Act, producing audit-ready documentation without the manual effort that traditional model validation workflows require.
SR 26-2 is direct on third-party model risk: banking organizations retain full responsibility for validating vendor models, even when vendors withhold proprietary code, data, or methodologies. The majority of enterprise generative and agentic AI deployments are third-party systems. Validating those systems without access to their internals requires a different approach than traditional model validation.
Automate FlightSim is built for this use case. It functions as a black-box validation service, evaluating generative and agentic AI systems regardless of whether they were built internally or sourced from a vendor. Rather than relying on vendor-supplied questionnaires, FlightSim runs a pre-deployment evaluation that tests system behavior from the outside using synthetic scenarios and simulation methods. It stress-tests beyond expected inputs to probe edge cases, prompt injection vulnerabilities, jailbreak susceptibility, toxicity, and bias. The output is a FlightSim Report with a letter grade for each governance principle and a recommendation on whether the system is fit for purpose.
SR 26-2 sets the standard for traditional model risk management and formally acknowledges that generative and agentic AI require separate governance frameworks. Institutions cannot wait for a dedicated federal MRM standard for generative AI to emerge. The NIST AI RMF and EU AI Act provide that structure today, and examiners will expect institutions to have applied it.
Monitaur's Common Controls establish the governance baseline across all applicable frameworks. FlightSim provides the independent, black-box testing required to validate the third-party generative and agentic systems that make up the bulk of enterprise AI deployments. Together, they give risk and compliance teams the documented, defensible evidence needed to demonstrate that governance of these systems is operational, not theoretical.
