Model Risk Guidance and LLM Agents: Generative and Agentic AI Are Outside the Revised Scope

What changed and when

On April 17, 2026, the OCC, the Federal Reserve Board and the FDIC issued revised model risk management guidance and rescinded the existing guidance. The Federal Reserve issuance, SR 26-2, supersedes SR 11-7 (April 4, 2011) and SR 21-8, the interagency statement on model risk management for Bank Secrecy Act compliance systems. The OCC issued the same content as Bulletin 2026-13.

Teams that planned to test an LLM agent against the SR 11-7 definition need to adjust. The revised guidance states that generative AI and agentic AI models are novel and rapidly evolving and, as such, are not within its scope. Its principles apply to traditional statistical and quantitative models and to non-generative, non-agentic AI models. For tools, processes or systems the document does not cover, it says a banking organization's risk management and governance practices should guide the appropriate governance and controls.

The guidance is supervisory guidance. It sets no enforceable standards or prescriptive requirements, and the agencies state that non-compliance will not result in supervisory criticism. It is expected to be most relevant to banking organizations with over $30 billion in total assets, and it may also matter to smaller organizations with significant model risk exposure. The agencies have said they plan to issue a request for information on model risk management that would consider banks' use of AI, including generative and agentic AI.

Applying the model definition to an agent

The revised guidance defines a model as a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates. It says the term excludes simple models. Compared with the framework in the 2021 interagency statement, the wording adds "complex" and drops "mathematical" and "techniques, and assumptions."

The scope statement is the deciding text for agents. It is framed around generative and agentic AI models as a category, and it does not divide an agent into a foundation model, prompts, retrieval, tools and orchestration. A standalone LLM and an agent built on one are both generative AI, so the exclusion does not turn on which of them you are assessing. The text does not tell you how to treat each layer, and a component-by-component view is a matter of institutional judgment, not a reading of the guidance.

One point that is practitioner inference, not stated in the guidance: a deterministic scoring or statistical component that an agent calls may fit the model definition on its own, even though the agent as a whole is excluded. Treat that as a judgment to document, applying the definition, the simple-model exclusion and materiality to that component.

Component view: what the text settles and what it leaves to judgment

The table separates what the guidance states from what an institution must decide. The guidance does not address agent components individually, so the right-hand entries are working positions for your own policy.

• Agent as a system: Stated: generative and agentic AI models are outside scope. Internal governance applies.
• Foundation model: Generative AI, so within the stated exclusion. Govern under internal policy.
• Prompts and orchestration logic: Not addressed. Treat as configuration of the agent and manage under internal change control.
• Retrieval sources: Not addressed. Treat as input data to the agent and assign ownership under internal policy.
• Tool permissions: Not addressed. Treat as an access and action control owned by the institution.
• Non-generative models the agent calls: Within stated scope if they meet the definition. Inventory and assess against materiality.

What examiners may ask, and what is inference

Because the guidance excludes agents, an examiner cannot point to a model-definition obligation as the reason to request agent evidence. Expectations are more likely to come from safety-and-soundness practice and from your institution's own policy. That is inference, and examiner practice is not described in the guidance.

The OCC has also published a supervisory framework for bank use of what it calls super intelligence. Its release says it is more applicable to generative and agentic AI because the Bulletin 2026-13 principles apply to non-generative and non-agentic models. It assesses the consequences if a system or agent's output or action is not fit for purpose, and it identifies controls that may prevent unauthorized, inappropriate or unsafe actions. It also says AI use can introduce, amplify or modify risk in existing categories such as operational, compliance and credit risk, and that those risks should be identified, measured, monitored and controlled under the bank's risk management framework.

The practical consequence is that a model risk team can still be asked how it decided an agent was out of scope, what standard replaced the guidance, and who owns the mapping between the two. A written answer is more defensible than an assumption in either direction.

Where runtime enforcement supports these expectations

An agent's behavior depends on inputs, retrieved content and tool results that exist only at runtime, and its outputs are not deterministic. A validation exercise before deployment cannot observe every path the agent will take. Controls at the level of the individual interaction and tool call address part of that gap.

Trussed enforces policy in the execution path across models, agents, tools and MCP servers. For each interaction or tool call, a policy decision is made at runtime, not reviewed after the fact: allow, redact, block, rate limit, or escalate for human approval. Each enforcement action produces audit-ready evidence of what the policy permitted and what happened. That evidence maps to frameworks such as NIST, and it speaks directly to the question the OCC framework raises about preventing unauthorized, inappropriate or unsafe actions. Trussed is deployed self-managed in the customer cloud, with configurable retention and data residency.

The limits matter. Runtime enforcement does not validate a foundation model, assess conceptual soundness or replace independent review, and nothing in the guidance says it does. Trussed does not provide model lineage or end-to-end tracing of agentic workflows. It supports governance of agent behavior with interaction-level evidence, while pre-deployment validation, independent review and your scope determination remain with the institution. Trussed has operated in production in regulated enterprises, with insurance being where it is deepest. It does not claim financial-services deployments.