Generative and agentic AI after SR 26-2: what changes for banks?

TL;DR: Lumenova AI says SR 26-2 replaces SR 11-7 but explicitly leaves generative and agentic AI outside model risk management, creating a governance gap that banks must cover with separate controls, examiner-ready evidence, and frameworks such as NIST AI RMF and ISO/IEC 42001. The carve-out changes scope, not supervisory exposure, so undocumented AI inventory and ownership become the new failure mode.

Editorial analysis by NHI Mgmt Group, based on content published by Lumenova AI: “After SR 26-2: A Control Framework for the Generative and Agentic AI Your MRM Program No Longer Covers”.

Key questions

Q: Why do generative and agentic AI create problems for traditional model risk management?

A: Traditional model risk management assumes stable inputs, stable outputs, and a bounded decision path that can be validated before deployment.

Q: Why do banks still face supervisory risk if generative AI is outside SR 26-2?

A: Because scope exclusions do not remove legal, conduct, privacy, or third-party obligations.

Q: How should banks govern hybrid AI pipelines that feed regulated models?

A: They should treat the AI-to-model hand-off as a control boundary.

Practitioner guidance

• Define a separate AI governance inventory Catalog every generative and agentic system, including owner, intended use, data touched, tools used, and whether it sits inside or outside model risk management.
• Record scoping decisions as controlled evidence Store the rationale, approver, and review date for each system classification so examiners can see why a workload was treated as in scope or out of scope.
• Assign explicit ownership for hybrid pipelines Name the business owner, second-line reviewer, and validation owner for any workflow where generative output feeds a regulated model or decision process.

Bottom line: SR 26-2 narrows model risk management, but generative and agentic AI still need explicit governance because their operational risk does not vanish with the scope change.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →