SR 11-7 Replaced: What the New Model Risk Guidance Means

SR 11-7 was the Federal Reserve's 2011 guidance on model risk management, paired with OCC Bulletin 2011-12. On April 17, 2026, the Fed, OCC, and FDIC replaced it with SR 26-2, which narrows what counts as a model and scales oversight to risk and materiality.

The change matters beyond banks themselves. Software vendors, asset managers, and service providers that answer bank due diligence and security questionnaires will see the vocabulary of model risk shift. This guide covers what the Federal Reserve's SR 26-2 letter and the FDIC announcement say, where expectations got lighter, and what response teams should do next.

What changed when SR 26-2 replaced SR 11-7

The Federal Reserve letter is titled Revised Guidance on Model Risk Management and is dated April 17, 2026. It supersedes SR 11-7, issued April 4, 2011, and SR 21-8, the 2021 interagency statement on model risk for Bank Secrecy Act and anti-money laundering systems. The OCC and FDIC issued the same guidance and rescinded their parallel documents, including OCC Bulletin 2011-12 and FDIC FIL-22-2017, as law firm Orrick details in its summary of the changes. The table below compares the two versions.

Two themes run through the changes: less prescription and more judgment. The FDIC states that the new guidance is nonbinding, sets no enforceable standards or prescriptive requirements, and that noncompliance on its own will not lead to supervisory criticism.

Who the revised guidance applies to

The Federal Reserve says the guidance is expected to be most relevant to banking organizations with over $30 billion in total assets. Orrick notes that the prior guidance applied to institutions with $1 billion or more. Smaller institutions are not shut out. The FDIC says model risk management should be scaled to each organization's size, complexity, and model risk profile, so a community bank with significant model exposure still has reason to follow the principles.

A narrower definition of a model

SR 26-2 defines a model as a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates. Orrick reports that the definition no longer reaches methods based on mathematical theories alone, and that it carves out simple arithmetic such as spreadsheets, deterministic rule-based processes, and software without underlying statistical, economic, or financial theories. Some tools that sat in a bank's model inventory under the old reading may now fall outside it, which makes an inventory review a sensible first step.

Materiality now drives how much oversight a model gets

Overall model risk is assessed by weighing inherent risk, which covers complexity, assumptions, and data quality, against materiality, which combines exposure and purpose. Orrick reports that low-risk, immaterial models can receive lighter oversight, such as identification and performance monitoring. That replaces the sense that every model in the inventory needs the same full treatment.

How SR 11-7 validation expectations changed

Validation still rests on conceptual soundness, outcomes analysis, and ongoing monitoring. The revised text treats each more concisely and drops detailed procedures such as VaR backtesting and override analysis, according to Orrick. Advisory firm Bonadio reports that annual validation is not required and that the OCC's clarification says examiners will not criticize less frequent or less extensive validation where it is reasonable. The guidance defines effective challenge as the critical analysis conducted by objective experts who evaluate model risk and effect appropriate changes, and Orrick adds that structural independence requirements are de-emphasized in favor of review rigor and effectiveness.

Vendor and third-party models

A standalone section addresses vendor products. It states that validating vendor products, whether by internal or outside parties, is an important element of model risk management and that the principles remain applicable. Bonadio reports that banks should understand a vendor model's design and limits, perform outcomes analysis and monitoring, and document any overlays, and that access to source code or full redevelopment is not required. Vendors should expect bank customers to keep asking for clear documentation of how a model or AI feature works. Our guide to vendor risk management covers how to build a program around those requests.

Where generative and agentic AI fit

Footnote 3 of the guidance states that generative AI and agentic AI models are novel and rapidly evolving and are not within its scope. That is not a free pass. Orrick notes that banks should rely on broader risk management and governance practices for these tools, and that the agencies plan to seek public input on AI through a request for information. Teams that need a structure today can look to the NIST AI Risk Management Framework, released January 26, 2023, and our practical guide to the NIST AI RMF. The exclusion also raises the stakes for unapproved tools, so see how regulated teams handle shadow AI.

What response and compliance teams should do now

If you answer due diligence or security questionnaires from banks, treat this as a prompt to refresh your model risk answers. Review any response that cites SR 11-7 and update the reference where a customer now points to SR 26-2. Confirm which of your features meet the narrower model definition, and be ready to describe validation, monitoring, and human review in plain terms. Keep one approved answer for each topic so every questionnaire says the same thing, and have counsel confirm how the guidance applies to your situation.

RocketDocs Private AI is built around those habits. According to the platform page, each customer has a dedicated document store, every generated response is flagged for human review, responses carry citations back to approved content, and actions are captured in an immutable audit log. Those are the kinds of controls a bank reviewer expects to see when AI touches a response.