What the regulators have said

The Federal Reserve, FDIC and OCC issued revised interagency guidance on model risk management on April 17, 2026 (SR 26-2). It replaces the 2011 guidance. Four points matter for AI.

  • Generative and agentic AI are outside the guidance because they are new and evolving quickly. Banks should still apply their broader risk and governance practices to them.
  • The guidance does cover traditional statistical models and non-generative, non-agentic AI.
  • Banks should keep information on the models in development or in use, with enough detail to understand model risk individually and in total. The detail can scale with the bank’s model use.
  • The guidance is most relevant to banks with more than $30 billion in assets. Smaller banks are generally expected to use practices suited to their size and risk, though it can apply to a smaller bank with significant model risk. The guidance itself is not enforceable, and noncompliance alone is not a basis for supervisory criticism.

The OCC’s Spring 2026 Semiannual Risk Perspective says banks have used AI for years and that generative and agentic use is generally limited to specific cases with guardrails and human accountability, mostly productivity and customer experience tools. It lists the distinct challenges as explainability, data privacy, data poisoning, cybersecurity and validation, and says industry approaches are still evolving. It also says the OCC is reviewing its expectations so community banks, including those that rely on third-party technology, can benefit from AI.

Why a community bank needs an inventory anyway

You cannot govern what you cannot list. Most community banks do not build AI themselves. It arrives inside vendor products, such as fraud detection, BSA monitoring and customer service tools, and through staff using public tools on their own. A bank that cannot say where AI touches customer data or a decision has no way to answer an examiner, a board member or an auditor who asks.

What to put in it

This is our suggested list, not a regulatory template. A spreadsheet is enough.

Field What to record
Tool and vendor Name, the vendor, and whether AI is a main feature or an add-on
Use What it does and which business line uses it
Data What customer or bank data it sees, and where that data goes
Decision role Whether it informs, recommends or makes a decision, and who checks it
Type Traditional model, non-generative AI, or generative or agentic AI
Materiality How much exposure or regulatory weight it carries: high, medium or low
Owner The person accountable for it
Last review The date the use was last reviewed

What to do now

  1. Ask your vendors. Request a list of AI features in the products you use, and note when a vendor adds one.
  2. Ask your staff. Find out which public AI tools people use for work, and decide what is allowed. An anonymous survey gets honest answers.
  3. Build the list and tier it. Rank by exposure and purpose, as the model guidance does. Light oversight for a drafting aid is fine. A tool that touches credit, BSA or customer data needs more.
  4. Write a short use policy. Say what data may go into which tools and who approves new ones.
  5. Set a review date. Revisit the list each quarter. New AI features arrive in vendor updates without announcement.

Our audit and regulatory advisory teams help community banks build this inventory and fit it into their risk and vendor programs.