SR 11-7

For more than a decade, SR 11-7 was the reference point for how banks managed the risk of relying on models. Issued by the Federal Reserve in April 2011, alongside a matching bulletin from the Office of the Comptroller of the Currency, it set out what supervisors expected: sound model development, independent validation with effective challenge, and strong governance over the full model lifecycle. The FDIC adopted the same guidance in 2017. Banks built entire model risk functions around it, and its ideas spread to insurers, asset managers and AI governance programs well beyond banking.

In April 2026, the Federal Reserve, OCC and FDIC rescinded SR 11-7 and replaced it with revised model risk management guidance, issued by the Federal Reserve as SR 26-2. The new guidance is more risk-based, narrows the definition of a model, is aimed mainly at larger banking organizations and explicitly excludes generative and agentic AI from its scope. For risk, compliance, data science and audit teams, understanding both SR 11-7 and what replaced it is essential, since many existing model risk programs and vendor contracts still refer to the older guidance.

Definition of SR 11-7

SR 11-7, Supervisory Guidance on Model Risk Management, was a Federal Reserve supervision and regulation letter that described model risk, defined what counted as a model and set out expectations for model development, implementation and use, model validation, and governance, policies and controls at banking organizations.

It shaped the practice of model risk management, set the standard for model validation and influenced how many organizations approach AI risk management.

Key Concepts in SR 11-7

A model was defined broadly as a quantitative method, system or approach that applies statistical, economic, financial or mathematical theories and assumptions to turn input data into quantitative estimates.

Model risk was described as the potential for adverse consequences from decisions based on incorrect or misused model outputs. It recognized that even a well-built model could cause harm if used for the wrong purpose.

Effective challenge meant critical analysis by objective, informed parties who could identify model limitations and assumptions and push for changes.

Validation was expected to cover conceptual soundness, ongoing monitoring and outcomes analysis, such as back-testing.

Governance covered board and senior management oversight, policies, roles, a model inventory and internal audit's review of the framework. These elements became standard features of bank risk programs.

What Changed in 2026

The revised guidance, issued in April 2026, rescinded SR 11-7 and the matching OCC and FDIC guidance, along with several related statements.

It narrows the definition of a model, excluding simple arithmetic, spreadsheets and deterministic rule-based processes.

It is described as most relevant to banking organizations with more than $30 billion in assets, while noting that smaller banks with significant model risk may find it useful.

It is framed as non-binding, takes a more risk-based approach to oversight and treats validation independence and effective challenge more flexibly.

It excludes generative and agentic AI models from scope as novel and rapidly evolving, and the agencies have said they plan to seek information on banks' use of AI.

Importance of SR 11-7 in AI Governance

SR 11-7 created a widely copied blueprint. Its inventory, tiering, validation and monitoring practices became the foundation of model risk programs across financial services and beyond.

It influenced AI governance. Many organizations governing machine learning models started from SR 11-7 principles, such as independent validation and effective challenge. These principles remain useful even where the guidance no longer applies.

Its replacement changes expectations. Banks must now review programs built on SR 11-7 against the new guidance and decide how to govern generative and agentic AI, which the new guidance does not cover.

SR 11-7 and Financial Management

Model risk programs built under SR 11-7 often required large validation teams, and the more risk-based 2026 guidance may let banks focus resources on their most material models.

Narrowing the model definition can reduce the number of tools requiring formal validation, lowering costs. Savings depend on how many tools fall outside the new definition.

Banks still need to manage the risks of excluded tools, including generative AI, through other controls, which should be budgeted.

Vendor contracts and policies that reference SR 11-7 may need updating, with associated legal and administrative costs.

Common Challenges

Many policies, procedures and vendor documents still cite SR 11-7, which can cause confusion after its rescission.

Deciding how far to relax existing practices under the new guidance requires judgment and supervisory dialogue. Some banks may keep stricter practices where they add value.

Generative and agentic AI now fall outside model risk guidance, so banks need separate governance to cover them.