SR 26-2 is updated supervisory guidance on model risk management issued by U.S. banking regulators. It replaces SR 11-7 and shifts banks toward risk-based governance, explicit materiality assessment, and stronger ongoing monitoring. The guidance is aimed primarily at larger banking organizations, while also informing how smaller institutions manage significant model complexity.
What SR 26-2 Changes in Model Risk Governance
SR 26-2 reflects a more risk-based supervisory posture for model risk management. Instead of treating all models as if they warrant identical treatment, it pushes banks to focus governance, testing, documentation, and oversight on the models that matter most to decision-making and financial or operational exposure.
The practical shift is not just procedural. It changes how institutions justify scope, prioritize reviews, and evidence control coverage. That is especially important where model inventories are large, ownership is diffuse, or multiple business units rely on the same model outputs.
Why Materiality Matters in Supervisory Review
Materiality assessment is the heart of the guidance because it determines how deeply a model should be governed and monitored. A model used for high-impact decisions, regulatory reporting, capital, credit, fraud, or trading deserves stronger challenge than a low-impact internal workflow model.
This makes model governance more defensible, but also more demanding. Banks need a consistent way to explain why a model is in scope, what risk it creates, and why the chosen level of validation is proportionate to that risk. The guidance also encourages institutions to avoid wasting effort on low-value controls while leaving important models under-supervised.
Ongoing Monitoring and Change Control
SR 26-2 places greater emphasis on ongoing monitoring because model risk does not end at approval. Drift in data, assumptions, business use, user behaviour, or surrounding systems can make a once-acceptable model unreliable over time.
That means monitoring is not just about accuracy metrics. It also includes watching for scope creep, degraded performance, changed dependencies, and incomplete retraining or recalibration decisions. For banks, the control question is whether governance can detect when the model’s real-world use has outgrown the assumptions under which it was approved.
What Institutions Should Be Ready to Show
Supervisors will expect a bank to show how it inventories models, assigns ownership, classifies materiality, and escalates issues when risk changes. The most credible programmes connect policy, evidence, testing, and exception handling into one lifecycle rather than treating model review as a periodic checklist.
That is why model risk management now sits closer to enterprise governance than to a narrow validation function. Institutions should be able to explain not only how a model works, but also who owns it, how changes are approved, how performance is reviewed, and how decisions are challenged when the model becomes more consequential.
Risk and Threat Considerations
Materiality-based model governance reduces waste, but it also creates exposure if an organisation misclassifies a model as low risk or fails to update its view after the model’s use expands. The main danger is false confidence: a model can remain operationally embedded long after its assumptions, data quality, or business purpose have changed.
Failure mechanism: Weak inventory discipline, poor ownership, or stale validation can let significant model errors persist undetected, especially when a model is reused across products or decision paths.
Impact: That can lead to flawed business decisions, control failures, regulatory findings, and in some cases direct customer harm or financial loss.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SA-11 — Developer Testing and Evaluation | Model risk guidance relies on structured testing and validation of model behaviour. |
| RA-3 — Risk Assessment | SR 26-2 centres on materiality-based risk assessment for model governance. | |
| Recommendation — Apply SA-11 to test model performance and challenge assumptions before production use. Use RA-3 to classify models by impact and focus controls on higher-risk use cases. | ||
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | The guidance shifts model oversight toward explicit risk-based governance decisions. |
| Recommendation — Align model governance with GV.RM-01 by defining how model risk is assessed and accepted. | ||
Practitioner Guidance
Why practitioners should care: The guidance rewards proportionate control design, but it also raises the bar for explaining why a given model deserves its level of oversight. Teams should be able to defend the materiality decision as clearly as the validation outcome.
What to watch for: Pay close attention when model purpose changes, data sources shift, users start relying on the model in new ways, or a “minor” model begins to influence important operational or regulatory decisions. Those are the moments when governance often lags reality.
Practitioner takeaway: Strong SR 26-2 compliance depends less on a single validation event and more on disciplined lifecycle governance, clear ownership, and continuous reassessment of model importance.
Related resources from NHI Mgmt Group
- What frameworks align best with SR 26-2 for AI governance programmes?
- Why do banks still face supervisory risk if generative AI is outside SR 26-2?
- How should banks redesign model governance under SR 26-2 without losing control over higher-risk models?
- How should security teams validate LLMs and agents under SR 11-7?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org