Topic starter
23/10/2026 12:45 am
TL;DR: 26-2 shows generative and agentic AI still need explicit governance, according to Lumenova AI's blog analysis. Banks need separate controls for inventory, permissions, and evidence retention once systems sit outside model risk management.
Editorial analysis by NHI Mgmt Group, based on content published by Lumenova AI: “After SR 26-2: A Control Framework for the Generative and Agentic AI Your MRM Program No Longer Covers”.
Key questions
Q: Why do banks still face supervisory risk if generative AI is outside SR 26-2?
A: Because scope exclusions do not remove legal, conduct, privacy, or third-party obligations.
Q: How should banks govern hybrid AI pipelines that feed regulated models?
A: They should treat the AI-to-model hand-off as a control boundary.
Q: Why do generative and agentic AI create problems for traditional model risk management?
A: Traditional model risk management assumes stable inputs, stable outputs, and a bounded decision path that can be validated before deployment.
Practitioner guidance
- Define a separate AI governance inventory Catalog every generative and agentic system, including owner, intended use, data touched, tools used, and whether it sits inside or outside model risk management.
- Record scoping decisions as controlled evidence Store the rationale, approver, and review date for each system classification so examiners can see why a workload was treated as in scope or out of scope.
- Assign explicit ownership for hybrid pipelines Name the business owner, second-line reviewer, and validation owner for any workflow where generative output feeds a regulated model or decision process.
Bottom line: SR 26-2 narrows model risk management, but generative and agentic AI still need explicit governance because their operational risk does not vanish with the scope change.
Glossary terms: Agentic AI, Model Risk Control, Hybrid AI Pipeline, Governance Boundary Drift
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:49 am
SR 26-2 creates a control gap, not a governance escape hatch. Once generative and agentic AI are carved out of model risk management, the old assumption that MRM is the universal AI control plane no longer holds. Banks still own the conduct, privacy, and third-party consequences of those systems, so the missing layer is accountable governance, not more model paperwork.
A few things that frame the scale:
- 54% of organisations are actively deploying AI agents across workflows, yet only 21% report a mature governance model for agentic AI.
A question worth separating out:
Q: What governance model fits agentic AI better than traditional MRM?
A: A layered AI governance model works better because agentic systems need inventory, permission scoping, monitoring, change control, and board reporting, not just statistical validation. MRM can remain one input where a model is involved, but it cannot be the only wrapper once a system can take actions, call tools, or delegate work.
👉 Read our full editorial: SR 26-2 leaves generative and agentic AI outside model risk scope
This post was modified 6 days ago by NHI Mgmt Group