Why the 2026 US model-risk revision does not cover every system called AI

The official generative-AI scope exclusion matters: map quantitative estimates, deterministic calculations and generated explanations separately before assigning controls.

The phrase model risk management can sound as though one framework covers everything a bank calls AI. That assumption is unsafe. A statistical estimate, a deterministic calculation, a language-model explanation and an agent that changes a record can sit in the same customer process while having different purposes and different policy boundaries.

The United States' revised 2026 guidance makes this distinction especially visible. This article reads the official letter and its attachment alongside British survey evidence and a Singapore announcement. The sources were checked on 15 October 2026. The practical example is fictional and is not a legal opinion about a particular bank.

The US revision is not a universal generative-AI framework

[Federal Reserve letter SR 26-2, dated 17 April 2026](https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm), replaces SR 11-7 and SR 21-8. It describes a risk-based approach and says the guidance is expected to be most relevant to banking organisations above US$30 billion in assets. The letter is not a statement that every small bank uses identical controls.

The [attachment's footnote 3](https://www.federalreserve.gov/supervisionreg/srletters/SR2602a1.pdf) explicitly places generative and agentic AI outside this guidance's scope. It nevertheless points to an institution's governance for tools outside the document. Exclusion from one guidance is not exemption from every applicable obligation. The letter and attachment are two documents from one guidance package, not independent studies.

The [Bank of England/FCA survey published 21 November 2024](https://www.bankofengland.co.uk/report/2024/artificial-intelligence-in-uk-financial-services-2024) reports 118 responses and 75% respondent adoption. It distinguishes different forms of automation. These are historical self-reported UK-operation findings, not a worldwide 2026 bank census. [MAS's October 2026 announcement](https://www.mas.gov.sg/news/media-releases/2026/mas-sets-out-supervisory-expectations-on-responsible-ai-adoption-by-financial-institutions) has its own future implementation timetable.

Map the process before categorising its components

Imagine a fictional US bank preparing an internal explanation of a business customer's existing credit assessment. A statistical model produces a quantitative estimate. A deterministic application calculates a value from approved inputs. A language assistant helps a staff member locate the model documentation and draft an internal explanation. The customer decision remains within the bank's controlled process.

Write those components separately. For each, state what it receives, what it produces and what authority it has. The statistical model may estimate an outcome; the calculator follows a defined formula; the assistant generates language. Calling the whole chain AI does not identify which component introduced an error or which governance process applies.

This map should include the points where people intervene. A reviewer who can reject a generated explanation is different from a person whose only available button approves it. A staff member who sees the underlying quantitative output can inspect a proposed interpretation; someone shown only a fluent paragraph cannot perform the same review.

Separate a generated explanation from the actual decision reason

The assistant's role in the example is to organise approved information for internal review. It should not invent the reason a customer received a particular outcome. If the authoritative system does not expose enough information to explain the decision, the missing evidence needs investigation. A language model should not manufacture a plausible substitute.

Prepare a structured input containing the accepted result, relevant version identifier and approved documentation. Keep uncertain or absent fields visibly absent. Ask the assistant to distinguish a statement directly supported by the record from an interpretation requiring a specialist. A high confidence phrase is not evidence that it reconstructed the actual decision path.

The reviewer should be able to inspect the original model output and document passages. If the assistant selects a generic limitation that is unrelated to this record, the explanation fails even if the limitation is true elsewhere. The problem is application-specific fidelity, not merely whether the text contains technically correct sentences.

An inventory that preserves purpose and authority

| Component in the example | Output | Question for governance | | --- | --- | --- | | Statistical estimator | Quantitative estimate | What assumptions and limitations matter for this use? | | Deterministic calculation | Formula result | Were the inputs and arithmetic correct? | | Language assistant | Proposed explanation | Is every statement supported and within the allowed task? | | Human decision process | Accepted interpretation or referral | Who may accept, correct or escalate it? |

This is a proposed working map, not a classification ruling. Applicability depends on the actual institution, activity and instruments. Its purpose is to prevent a broad product label from concealing distinct sources of error.

Test cross-component failures

Build evaluation cases where one component is correct and another is wrong. For example, give the assistant a correct numerical result and an obsolete description of the model. In another case, make the documentation correct while the input record refers to a different version. The expected behaviour is to flag the mismatch, not produce a seamless explanation.

Include missing inputs, unusual business names and an outcome that the available documents cannot explain. A reviewer should record why the case is unresolved. A test that rewards completing every explanation will favour unsupported answers. Acceptance needs to reward correct boundaries, including a clear request for additional authoritative information.

Compare the assisted explanation with a reference produced through the existing process. Measure factual corrections, omitted limitations, version mismatches and time to accepted work. The model's response speed is only one part of the result. Avoid a universal saving claim or a claim that the bank can remove staff merely because drafting becomes faster.

Preserve records when policies and models change

An institution needs to know which rules and guidance informed a decision at the time. Keep the source date, effective-date interpretation and internal approval record separate from the publication's latest website modification. A later policy update should not erase the earlier record or make a historical review appear to have used a new instrument.

The same applies to model versions. Preserve the quantitative output, relevant configuration and accepted explanation under the bank's retention arrangements. A future reviewer should be able to distinguish an updated language assistant from a changed statistical estimator. If both change together without a record, the team loses the ability to locate the cause of a different result.

Source monitoring should identify changes for review rather than automatically translate them into permissions. A research report is not a legal instrument, and an announced guideline may have a future timetable. The October 2026 Singapore record is useful precisely because it makes its phased dates visible instead of leaving readers to infer immediate application.

Skills that become more valuable

Workers need to connect quantitative methods, business context and explanation quality. That does not mean every employee becomes a model developer. A credit specialist can identify an unsupported reason; a data engineer can identify a version mismatch; a governance reviewer can identify a scope mistake. The process should let each contribution affect the outcome.

A student can create a miniature process using an invented quantitative estimator and fictional records. Build two conflicting versions of the documentation and demonstrate that the assistant flags the conflict. Explain which output is calculated, which is generated and which requires a person. Do not connect real customer data or present the project as a certified credit system.

What readers should take away

The important question is not whether a bank says it has AI governance. It is whether governance follows the actual components, authority and evidence of the process. The 2026 US revision supplies a specific boundary, while other jurisdictions have their own approaches. This is educational analysis of those distinctions, without recommending credit decisions, promoting a provider or offering a complete legal interpretation.

Workflow diagram and readable guide


Original diagram of a fictional worked example; not a regulator-issued checklist, compliance certification or actual deployment.

[Open the complete workflow diagram](/assets/financial-workflow-banking-model-boundaries-20261015.svg)

Read the diagram

**Different components, different questions**

The fictional credit-explanation process

1. **Quantitative estimator.** Quantitative estimate Check assumptions and limitations.

2. **Deterministic calculation.** Defined formula result Check accepted inputs and arithmetic.

3. **Generated explanation.** Draft supported explanation Never invent a missing decision reason.

4. **Human decision and referral.**

**Boundary to retain.** Quantitative estimate Check assumptions and limitations. Deterministic calculation Defined formula result Check accepted inputs and arithmetic. Generated explanation Draft supported explanation Never invent a missing decision reason. Human decision and referral Acceptance, correction or referral Inspect the underlying record, not only prose. SR26-2 excludes generative and agentic AI from its scope. Other governance still needs review.

*Falcon World · Fictional educational example*