Generative AI is outside the new model risk guidance. What community banks and credit unions should do now.

On April 17, 2026, the Federal Reserve, OCC and FDIC issued revised interagency guidance on model risk management (Federal Reserve SR 26-2 and OCC Bulletin 2026-13), replacing the 2011 guidance known as SR 11-7. Two points matter most for community institutions: the guidance says it is expected to be most relevant to banks with more than $30 billion in assets, and it states that generative AI and agentic AI are not within its scope.

What changed, and what did not

The revised guidance is principles-based and says it does not set enforceable standards. For most community banks it lowers the bar on formal model validation. It does not mean AI is unregulated. Generative AI tools still touch customer data, vendor relationships, consumer protection obligations and board oversight, all of which examiners already review.

Where AI governance now lives

• Third-party risk. Most AI at a community institution is inside vendor products. The 2023 interagency third-party guidance remains in effect, and the agencies proposed a revised version in September 2026. Either way, due diligence, contracts and monitoring apply to vendor AI. Credit unions should follow NCUA’s third-party due diligence guidance.
• Information security. Customer information entered into AI tools is covered by your GLBA information security program.
• Consumer protection. AI in credit decisions still has to support specific adverse action reasons under ECOA and Regulation B.
• Board oversight. Directors should approve AI policy and risk appetite and receive regular reporting.

A practical checklist for the next 90 days

1. Build an AI inventory that includes AI features inside core, digital banking, fraud, BSA/AML, lending and contact-center products, not just staff chatbots.
2. Add AI questions to vendor due diligence: does the vendor train on your data, how long is data retained, who are the sub-processors, how is the AI monitored, and what audit rights do you have?
3. Adopt a short AI acceptable-use policy approved by the board, with a named owner and an approval process for new tools.
4. Lock down productivity AI. Review Microsoft 365 Copilot or similar tools against file permissions before broad rollout.
5. Map AI controls to your framework (NIST CSF 2.0, CRI Profile or similar) and to the NIST AI RMF, so the evidence is ready when examiners ask.
6. Report to the board quarterly on AI use, vendor changes and incidents.