There is still no single US federal AI statute for financial institutions, and mid-2026 made clear there will not be one soon. What exists instead is a layered regime that changed shape twice this spring: Treasury issued a financial-services AI risk framework early in the year, and on 17 April 2026 the OCC, Federal Reserve, and FDIC jointly rescinded the model-risk canon that had governed bank models since 2011, SR 11-7, OCC Bulletin 2011-12, and FIL-22-2017, replacing it with a unified, principles-based framework known on the Federal Reserve side as SR 26-2.
The surprising part of the reset is its direction. Traditional model risk governance got narrower, not broader: the agencies explicitly placed generative and agentic AI outside the scope of the new model-risk guidance, on the reasoning that these systems are too novel and fast-moving for the traditional framework. The governance burden did not shrink with the scope. It moved, into third-party risk management, cybersecurity, fair lending, UDAAP, recordkeeping, and state law.
For a compliance or model-risk leader, the question is no longer whether AI is covered. Everything is covered by something. The work is mapping each use case to the layer that covers it, and noticing where the layers overlap or leave a system governed only by expectations that were never written with it in mind.
The model-risk reset and its carve-out
SR 26-2 and its OCC and FDIC parallels apply most directly to larger banking organisations, while remaining relevant to smaller firms wherever model risk is material. For conventional models, credit scorecards, valuation models, stress testing, the practical continuity is high: principles-based language replaces the older prescriptive text, but the expectations of sound development, validation, and governance carry forward.
The structural novelty is the exclusion. Generative and agentic AI sit outside the guidance’s scope, which means a bank’s most scrutinised new systems are precisely the ones its model-risk framework no longer formally reaches. The agencies were explicit that this is not deregulation: these systems remain governed through other supervisory channels, and examiners will use them. The operating implication is that a model risk function which defines its inventory by “what SR 26-2 covers” will build a blind spot exactly where board attention is. The firms handling this well keep one inventory covering everything, tag each entry with its governing regime, and apply validation-grade discipline to generative systems voluntarily, evidenced against the adjacent authorities that do apply.
Treasury’s framework is becoming the benchmark
Treasury’s sector framework, circulating as the Financial Services AI Risk Management Framework, is a financial-sector adaptation of the NIST AI RMF: a control-objectives document, with 230 control objectives mapped to AI risk-management principles and designed to integrate with existing compliance programmes rather than replace them.
It is guidance, not rule. But industry commentary already treats it as a de facto governance standard, with the expectation that it hardens into examination benchmarks over time, and that pattern is familiar from earlier framework adoptions. The pragmatic response is a mapping exercise: take your existing AI governance controls, map them against the framework’s control objectives, record which objectives you meet, which you meet differently, and which you have consciously declined, with reasons. That document costs a few weeks and converts an open-ended exam conversation into a review of a considered position.
The SEC and the states
The SEC has adopted no standalone AI rulebook for issuers, advisers, or broker-dealers. Its posture runs through existing securities-law authority: disclosure controls, books-and-records, anti-fraud, internal controls, and supervisory obligations apply whenever AI touches filings, trading, communications, or customer interactions. Reporting on the supervisory climate reinforces that oversight of AI at financial firms runs primarily through existing risk-management tools. The regulatory logic is that AI is covered by existing law, and enforcement will arrive through familiar doctrines applied to unfamiliar systems: a hallucinated disclosure is a disclosure problem, an unsupervised AI-drafted client communication is a supervision problem.
The state layer is where new obligations are actually being written, and Colorado remains the jurisdiction to watch because its regime treats lending and other financial services as consequential decisions. The structure shifted this year: SB26-189, signed on 14 May 2026 and effective 1 January 2027, replaces the earlier Colorado AI Act structure, removing the original impact-assessment and risk-management duties while preserving notice-related obligations for deployers. What survives still reaches directly into automated decision workflows: point-of-interaction notice and a plain-language description requirement tied to adverse outcomes. For underwriting and credit pipelines, that is a systems requirement, not a policy memo.
Operating a multi-regime compliance stack
The engineering consequence of a fragmented regime is that compliance becomes a mapping table you maintain, not a project you finish. The version of this that works in practice:
- One inventory, many regimes. Every AI use case carries tags for the layers that govern it: SR 26-2 for traditional models, TPRM and adjacent supervisory expectations for generative systems, SEC doctrines where filings or communications are touched, and state statutes keyed to customer location.
- Controls built once, mapped many times. A single testing, monitoring, and documentation stack, cross-referenced to Treasury control objectives, model-risk expectations, and state notice duties, beats four parallel compliance programmes. Most control objectives satisfy several regimes at once if the evidence is organised to show it.
- Vendor reach. Where scoring engines or generative capabilities come from third parties, the same mapping has to extend through the contract: audit rights, evidence delivery, and change notification, because TPRM is now a primary channel through which regulators reach your AI.
- A watch process with owners. The April rescission retired fifteen years of settled guidance in one release, and Colorado rewrote its statute a year after passing it. Assign each layer an owner, review the map quarterly, and treat regime change as a standing operational risk rather than a surprise.
The cost of this regime is coordination, and the failure mode is assuming someone else’s layer covers you. The firms in the best position this year are not the ones that predicted the rules. They are the ones whose inventory, evidence, and mapping were in good enough order that a scope change in April was an edit, not a programme.
FAQ
Does the generative AI carve-out from SR 26-2 mean our LLM tools need less governance?
No, it means they need governance from a different direction. The agencies excluded generative and agentic AI from model-risk scope because the traditional validation framework fits them poorly, not because they are low risk. Examiners will reach the same systems through third-party risk management, cybersecurity, fair lending, UDAAP, and recordkeeping expectations. In practice we advise running LLM systems under model-risk-grade discipline anyway: inventory, testing, monitoring, and documented human review, mapped to those adjacent authorities.
Is the Treasury framework mandatory for banks and fintechs?
It is not a binding rule, but treating it as optional is a mistake. Industry commentary already describes it as a de facto governance standard, and frameworks of this kind tend to harden into examination benchmarks: examiners ask why you deviated, not whether you adopted it. The efficient posture is to map your existing AI controls against its control objectives, document the gaps you accept deliberately, and be able to explain that mapping in an exam.
How should a multistate lender handle Colorado's revised AI law?
Build the notice capability once and deploy it configurably. SB26-189, effective 1 January 2027, preserved notice obligations tied to consequential decisions, including point-of-interaction notice and a plain-language description connected to adverse outcomes, even though it removed the earlier impact-assessment duties. Since lending is squarely a consequential decision, wire notice generation into the decisioning workflow rather than the state-specific frontend, so the next state statute is a configuration change instead of a rebuild.