SR 26-2 Effective Date and Transition Timeline for Banks Moving Off SR 11-7

What SR 26-2 establishes and the date to plan from

The Federal Reserve lists SR 26-2 as Revised Guidance on Model Risk Management, dated April 17, 2026. The OCC published the same interagency guidance as Bulletin 2026-13 on that date. The agencies state three aims: clarify model risk management principles, set out a risk-based approach and rescind prior model risk management guidance and other issuances.

For a bank whose program was built around SR 11-7, the practical consequence is that the program now needs to be read against the new text. As of November 2026, the issuance date and the rescission of prior guidance are the fixed points for sequencing work. Legal and compliance should record in the program file how the rescission applies to SR 11-7 and to any agency adoptions of it, so internal policies cite the correct governing guidance.

On scope, the OCC says the guidance is expected to be most relevant to banking organizations with over $30 billion in total assets. That is a statement of relevance, not a legal threshold. Smaller banks should still document why their model risk practices are proportionate. The guidance states that practices effective for one organization may be ineffective for another with a different risk profile or model use.

Mapping SR 11-7 program components to SR 26-2

SR 26-2 discusses the factors that influence model risk and the features of effective practice in three areas. Most SR 11-7 programs already have components that correspond to each one. The mapping below is a starting structure for a gap review, not a statement of what changed line by line. Where the new text differs from your current policy wording, that difference becomes a remediation item.

• Model inventory and scope: Maps to model development and use. Confirm the inventory records each model's use, owner and risk tier, and that tiering reflects the risk-based approach.
• Development and testing standards: Maps to model development and use, including model testing. Check that documented testing is proportionate to model risk and extent of use.
• Independent validation: Maps to validation and monitoring, including validation of conceptual soundness. Review validation scope and depth by risk tier.
• Ongoing monitoring and outcomes analysis: Maps to validation and monitoring. Confirm outcomes analysis is performed, recorded and linked to model tiering.
• Policies, roles and responsibilities: Maps to governance and controls. Update policy references and confirm clear ownership across development, use, validation and oversight.
• Vendor and third-party models: The guidance recognises that banks may not receive underlying code, data or methodology from vendors, and that the principles still apply. Document compensating controls and outcomes analysis.

A phased transition plan

The phases below are internal planning constructs. They are not regulatory milestones, and each bank should assign its own dates, anchored to the April 17, 2026 issuance and scaled to its size, complexity and extent of model use. Sequencing matters more than the exact calendar: the inventory and policy decisions in the early phases determine how much work remains for validation and evidence later.

• Phase 1: Confirm position: Record the supersession position for SR 11-7, confirm applicability of the guidance to the bank and assign a program owner.
• Phase 2: Gap assessment: Compare each program component with the three areas of the guidance and rate gaps by risk and remediation effort.
• Phase 3: Policy and inventory updates: Revise policies, roles and tiering criteria. Update the inventory so scope decisions are explicit and justified.
• Phase 4: Validation and monitoring alignment: Adjust validation depth, outcomes analysis and monitoring cadence by risk tier, including vendor models.
• Phase 5: Evidence readiness: Assemble the artefacts an examiner could request and test whether they can be produced quickly and consistently.
• Phase 6: Review and attestation: Have internal audit or a second line review the updated program and report residual gaps to the board or risk committee.

Where interpretation falls to the institution

The guidance is risk-based and does not prescribe uniform practices. That is deliberate, and it moves the burden of justification to the bank. Examiners will assess whether the program is reasonable for the institution, so the rationale for each tiering, validation and monitoring decision should be written down. The agencies have not published detail beyond the guidance itself that a bank can rely on to predict examination procedures, so planning should avoid assuming specific examiner expectations.

AI systems are the clearest area where interpretation is needed. Many AI deployments involve behavior that is enforced at runtime through policies applied to individual interactions and tool calls, rather than fixed in a model that is validated once and monitored on a schedule. A bank has to decide how its definition of a model, its inventory and its validation approach apply to those systems. The guidance's general principles apply, but how they are met for a given AI system is the bank's call. Document the reasoning, the risk tier assigned and the controls that compensate where testing or vendor transparency is limited.

Where runtime evidence fits, and where it does not

Runtime policy enforcement produces one kind of evidence: a record of what an AI system was allowed to do and what it did in individual interactions and tool calls. Trussed enforces policy in the execution path, with decisions to allow, redact, block, rate limit or escalate for human approval, so policy is enforced at runtime, not reviewed after the fact. The enforcement generates audit-ready evidence that can support a bank's monitoring, controls and documentation.

This evidence supplements model risk management. It does not replace validation. Trussed does not cover validation of conceptual soundness, outcomes analysis, model lineage or dataset provenance, and those elements need their own evidence. The guidance text also does not describe runtime enforcement records, so how they fit a bank's program is an institutional decision.

Trussed has customers in four regulated verticals: insurance, pharma, healthcare and education, and is deepest in insurance, a regulated financial sector. It does not claim bank deployments. Banks evaluating this approach should judge it on the same criterion as any control: whether the evidence it produces answers the questions an examiner would ask.