SR 26-2 and Generative AI in Loan Operations: What Is and Is Not in Scope

What changed: SR 26-2 replaced the earlier reading

The Federal Reserve issued SR 26-2, Revised Guidance on Model Risk Management, on April 17, 2026. The OCC issued its counterpart, Bulletin 2026-13, the same day. The OCC states that the update rescinds prior model risk management guidance and clarifies that practices should be risk-based, tailored, and commensurate with a banking organization's size, complexity, and extent of model use.

The guidance describes generative AI and agentic AI models as novel and rapidly evolving. It states that its principles apply to traditional statistical and quantitative models and to non-generative, non-agentic AI models. Governor Bowman said on May 1, 2026 that the agencies amended the guidance to clarify that it does not apply to generative or agentic AI, and that supervisors had expanded the previous guidance's scope beyond its original purpose.

The Fed letter says the guidance is expected to be most relevant to banking organizations with over $30 billion in total assets regulated by the Federal Reserve, and that practices appropriately vary with risk profiles and model usage. The guidance itself says it may be useful for any type of model, and is most useful for models supporting significant business lines, operations, services, and functions.

Scope turns on model type, not on determinism

Many risk teams assumed that non-deterministic output was the reason generative AI would be treated as a model. The scope language does not work that way. The question SR 26-2 asks is what kind of model is in use, and then how much risk the usage carries. Generative models are excluded by type. Non-generative AI and traditional quantitative models are included, with practices tailored to usage.

Two consequences follow for loan operations. First, a generative tool does not move into scope because it touches credit files or sits close to an underwriting decision. Second, a non-generative component does not move out of scope because a generative tool sits next to it in the same workflow. Each component needs its own determination.

The boundary cases are where the guidance leaves room for judgment. Where a generative tool and a non-generative model interact, the line between them is an architecture decision, and the institution should document it for each workflow.

Sorting representative loan operations use cases

The sorting below is a practitioner's reading of the scope language, not a determination published by the agencies. Confirm each placement against your institution's model definition and record the rationale.

• Generative extraction of fields from application packages: Outside SR 26-2 as a model. If extracted fields later enter a scoring model, treat the handoff as a borderline boundary.
• Generative summarization of borrower documents: Outside SR 26-2 as a model. Risk comes from sensitive data exposure and reliance by staff, which other governance covers.
• Generative drafting of credit memos: Outside SR 26-2 as a model. Human review of the final memo remains an institutional control choice.
• Generative decision support for underwriting or servicing staff: Borderline. The generative exclusion applies, but the more the output effectively determines the outcome, the more institution-specific judgment is needed.
• Generative output used as an input to a scored or decisioning model: Borderline. The downstream non-generative model stays in scope, so document how upstream output is controlled.
• Traditional scorecards and non-generative ML classifiers: In scope. The principles apply, tailored to risk and usage.

Out of scope does not mean out of control

Bowman said the Fed expects other risk-management and governance practices to support the adoption of generative and agentic AI. The practices are not itemized in her remarks. Supervisory tone more broadly is to enable adoption while expecting banks to manage risks safely and soundly. For loan operations, that likely places more weight on existing third-party, operational and compliance governance, which may now carry oversight that model risk management does not.

Three practical steps follow. Inventory loan operations and document processing use cases and tag each as generative, non-generative AI, or rule-based. Record the scope rationale and the approver for each generative use case. Then review any program that applied pre-deployment validation to generative tools under the earlier, broader reading, and decide deliberately what to keep.

The posture may continue to change. The OCC, Fed and FDIC have said they plan to issue a request for information on model risk management that would consider banks' use of AI, including generative and agentic AI. Teams should watch for it, because it may alter how generative AI is treated.