Model risk management is the set of policies and controls a bank uses to manage the risk of losses or bad decisions from models that are wrong or used the wrong way. It covers how models are developed, validated, monitored, documented and governed, from credit scoring to fraud detection.
How does model risk management apply to generative AI?
Not directly, under the newest guidance. In April 2026, the Federal Reserve, OCC and FDIC issued revised model risk guidance (the Fed's SR 26-2), which replaced SR 11-7 as the core model risk guidance and leaves generative and agentic AI out of its scope.1 It says a bank's own risk management and governance practices should guide the controls for those tools. The guidance is aimed mainly at banks with more than $30 billion in assets; smaller banks and credit unions follow their own regulators' expectations.
In practice, it often makes sense to borrow model risk habits for AI anyway: a clear intended purpose, testing before launch, monitoring, and a review each time the use expands. We covered the data side in how banks can keep customer data in-region. More on our work with banks and credit unions.
Frequently asked questions
Is ChatGPT a model under bank model risk guidance?
Under SR 26-2, generative AI tools are outside the guidance's scope, so they aren't treated like credit or pricing models. Banks should still have a documented way to approve, monitor and control them through their broader risk management and governance, including third-party risk management for the vendor.
Sources
