In April, US banking regulators replaced the fifteen-year-old guidance that defined model risk management. The most important line in the replacement is a footnote: generative and agentic AI are out of scope. That is not an oversight. It is an assignment.
What this is not: SR 26-2 is supervisory guidance, not law, and it is written for banking organizations, mostly those over $30 billion in assets. "Out of scope" does not mean unregulated: existing obligations, from consumer protection to safety and soundness, still apply to whatever a bank deploys. But the directional signal reaches well beyond banking. For now, agent governance will be practitioner-led in every industry.
On April 17, 2026, the Federal Reserve, the OCC and the FDIC issued SR 26-2, a revised guidance on model risk management. It replaces SR 11-7, the 2011 letter that taught a generation of risk teams what a model inventory, validation and effective challenge look like. Fifteen years of supervisory experience, condensed into one document.
And then, in a footnote, the agencies step around the biggest story in the room: generative AI and agentic AI models "are novel and rapidly evolving. As such, they are not within the scope of this guidance."
The systems your organization is deploying fastest are the ones the flagship framework does not cover.
The footnote does not stop at the exclusion. Its next sentence says a banking organization's own "risk management and governance practices should guide the determination of appropriate governance and controls for any tools, processes, or systems not covered in this document."
Regulators did not write the rules for AI agents. They handed practitioners the pen.
This is the real story of SR 26-2. The rest of the letter is genuinely useful: a sharper risk-based approach, materiality thinking, proportionality for smaller institutions. But the footnote is where leadership lives. The agencies are saying, in plain supervisory language: you understand these systems better than we can write rules for them right now. Show us what good looks like.
Model risk management was built for artifacts. A model is a thing you can version, validate before first use, and monitor on a cycle. It takes inputs and returns estimates. Its worst day is a wrong number.
An agent is different in kind. It has goals, tools, credentials and memory. It calls APIs, moves data, drafts the email, touches the production system. Its worst day is not a wrong answer. It is a wrong action, executed a thousand times at machine speed before anyone notices.
That is why simply stretching SR 11-7 thinking over agents will not work. The unit of governance is no longer the model. It is the actor.
The spine of model risk management still works. It just needs to be pointed at behavior, not artifacts. Five moves borrow that spine and extend it:
None of this waits for a regulator. The World Economic Forum's work on agent evaluation and governance, and the security research coming out of firms like Sophos, show the practitioner community is already building these foundations. The question is whether your organization is building its own or waiting to inherit someone else's.
Adoption is not waiting. Wharton and GBK find roughly three in four enterprise leaders reporting positive ROI from generative AI, while BCG finds only about five percent of companies achieving AI value at scale. My read of that gap: the difference is not better models. It is operating discipline, and I believe governance sits at the core of it.
There will be an SR letter for AI agents one day, in banking and beyond it. The leaders who treat today's gap as an assignment will write the practices it cites. The ones who wait will inherit them.
I know which side of that footnote I want to be on.