Topic starter
25/10/2026 11:02 am
TL;DR: The April 2026 SR 11-7 rewrite removes generative and agentic AI from model risk management scope, according to Tetrate, which pushes banks away from legacy model governance assumptions and toward deployment-time controls for inventory, attribution, guardrails and telemetry. The real issue is not less regulation, but a narrower federal wrapper that leaves operational evidence and control design to the programme.
Editorial analysis by NHI Mgmt Group, based on content published by Tetrate: “SR 11-7 Just Wrote Itself Out of the GenAI Conversation”.
Key questions
Q: What should security teams do first when GenAI is outside traditional model risk management scope?
A: Start by routing all model and agent traffic through a governed control point that can log, filter and block requests.
Q: Why do AI agents need runtime controls instead of only pre-approved access?
A: Pre-approved access cannot tell you what the agent will do once prompts, tools, memory, and sub-agents start interacting.
Q: How do organisations know whether AI governance is actually working?
A: AI governance is working when teams can prove that data access, identity permissions, and runtime controls line up with policy in practice.
Practitioner guidance
- Implement request-path model governance Force every GenAI and agentic AI request through a controlled gateway that can log, filter and block before the response or tool action occurs.
- Build an accurate-by-construction inventory Capture model, agent and tool usage automatically from the execution path so the register reflects reality instead of manual updates.
- Add request-level attribution Record business unit, application and agent context for each model call so examiners can trace usage back to accountable owners.
Bottom line: GenAI governance now depends on runtime evidence, not on assuming model risk management can carry agentic systems by extension.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →