What changes with SR 26-2: model risk management guidance

SR 26-2 is the new U.S. federal guidance on model risk management in banking, replacing SR 11-7 after 15 years. Key changes include: a shift from prescriptive rules to principles-based oversight, scope narrowed to institutions with over $30 billion in assets, a tighter definition of 'model' that excludes simple spreadsheets and rule-based tools, replacement of annual revalidation cycles with risk-based cadence tied to model materiality, and a redefinition of validator independence focused on rigor rather than reporting structure. Notably, generative AI and agentic AI are explicitly excluded from SR 26-2's scope, requiring institutions to build parallel governance frameworks. The core intellectual architecture from SR 11-7 — effective challenge, conceptual soundness, outcomes analysis, and ongoing monitoring — remains intact.