US bank regulators overhaul model risk management guidance, explicitly exclude generative and agentic AI from scope

On April 17, 2026, the OCC, Federal Reserve, and FDIC jointly replaced the 2011 model risk management framework with revised guidance that is more principles-based, raises the primary applicability threshold from $1B to $30B in assets, and explicitly excludes generative and agentic AI from its definition of "model" on the basis that such technologies are "novel and rapidly evolving." The guidance also clarifies that non-compliance will not result in supervisory criticism, marking a deliberate deregulatory shift in tone. For financial institutions, this creates a near-term compliance gap: banks deploying generative or agentic AI must govern those tools under general risk management practices rather than a defined regulatory framework, while awaiting a forthcoming interagency RFI that may shape future AI-specific expectations. Also reported by: https://www.occ.treas.gov/news-issuances/news-releases/2026/nr-occ-2026-29.html · https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm · https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-13.html