There's No Rulebook For AI In Compliance Yet—That's Not Permission To Skip Explainability
What happened
The Federal Reserve, along with the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation, updated their model risk guidance for banks, known as SR 26-2. This new guidance, issued in 2024, specifically excludes generative and agentic AI models because these technologies are still rapidly evolving. Despite this exclusion, banks are instructed to use their existing risk management and governance practices when deploying AI systems. The guidance emphasizes that explainability alone is not enough; banks must ensure AI decisions can be audited and challenged, with controls in place throughout the AI workflow.
Key details
- SR 26-2 replaces 15-year-old model risk guidance for banks.
- The guidance is most relevant for banks with over $30 billion in assets.
- Generative and agentic AI models are excluded from the scope due to their novelty.
- Banks are directed to apply existing risk management frameworks to AI use.
- AI decisions must be auditable, reconstructable, and contestable, not just explainable.
Why it matters
Large U.S. banks using AI must continue to manage risks under existing frameworks, even though there is no detailed rulebook for generative or agentic AI. This means compliance teams cannot delay implementing controls for AI systems and must ensure that every AI-driven decision can be traced, audited, and challenged. Vendors supplying AI tools to banks are also required to provide enough transparency and evidence to support these controls, affecting how banks evaluate and contract with technology providers.