What SR 11-7 was designed for
SR 11-7, issued by the Federal Reserve and OCC in 2011, defines model risk management for financial institutions. It establishes three pillars: model development, implementation and use; model validation; and ongoing monitoring. The guidance has been the backbone of MRM practice for over a decade.
Its design assumptions are those of classical quantitative models: a defined objective function, training data with known provenance, outputs that are deterministic given the same inputs, and a validation process centered on back-testing and statistical performance metrics. A credit scoring model that predicts probability of default is exactly what SR 11-7 was built to govern.
A large language model that generates free-form text, retrieves documents from a vector database, and executes multi-step tasks through tool calls is not.
SR 26-2 and the GenAI carve-out
In April 2026, the Federal Reserve issued SR 26-2 — new guidance that updated MRM principles for the AI era. It addressed AI-specific risks including model complexity, data quality, explainability, and fairness.
What it explicitly did not do: govern generative AI. Footnote 3 of SR 26-2 states that the guidance does not apply to generative AI systems or agentic AI deployments. The Federal Reserve acknowledged that generative AI introduces governance challenges sufficiently distinct that a separate framework is needed — but that framework has not yet been published.
The practical consequence: every GenAI deployment in a US bank — chatbots, document summarization pipelines, agent-based underwriting assistants, RAG systems for compliance Q&A — falls under SR 11-7 by default, because there is no other applicable guidance. SR 11-7's model validation requirements were not written for these systems, but they are what regulators will reference in an examination.
The four governance gaps
Gap 1: SR 11-7 validation assumes deterministic outputs
SR 11-7 validation centers on back-testing: run the model on historical data, compare outputs to known outcomes, measure deviation. This works when a model produces a score. A generative model produces text — different text on different runs for the same prompt. Statistical back-testing doesn't capture hallucination rates, prompt injection susceptibility, or the frequency with which the model produces regulatory violations. The validation methodology needs extension, not substitution.
Gap 2: SR 11-7 doesn't address the input surface
Classical models receive structured inputs: a set of features, engineered from source data, with known ranges and validation rules. A GenAI model receives natural language — and natural language can be adversarially constructed to manipulate model outputs. Prompt injection, jailbreaking, and indirect manipulation via retrieved documents are attack surfaces that SR 11-7's model risk taxonomy doesn't cover. A governance framework that doesn't account for how the model can be attacked from the input side is incomplete.
Gap 3: SR 11-7 treats "the model" as a bounded artifact
In SR 11-7's world, a model is a defined artifact: a set of equations or weights, with a specific input-output mapping, that can be versioned and validated. A RAG pipeline or agent system is a compound artifact — a retrieval system, a context-construction step, a language model, possibly multiple tool calls, possibly other agents. The risk is distributed across the pipeline, and no single component validation covers the whole. What fails in production is usually not the model in isolation — it's the interaction between the model, the retrieval context, and the tool invocations.
Gap 4: SR 11-7 ongoing monitoring assumes measurable outputs
Ongoing monitoring under SR 11-7 centers on performance metrics: model accuracy, stability, drift. For a generative model serving thousands of customer interactions per day, what does drift look like? You can measure refusal rates, latency, and token counts — but these don't tell you whether the model's outputs have started drifting toward regulatory violation, financial advice, or factually incorrect responses. Monitoring a generative model requires instrumenting the output classification layer, not just the model serving infrastructure.
What MRM teams should do now
SR 11-7 remains the applicable framework. The right response is not to wait for a GenAI-specific regulatory update — which is coming, but not yet published — but to extend SR 11-7's three pillars with GenAI-specific supplements:
- Development and implementation: document the full pipeline (retrieval, context, model, tools), not just the model weights. Record prompt design decisions and their risk rationale alongside training decisions.
- Validation: extend back-testing with adversarial evaluation — test how the pipeline responds to prompt injection, jailbreak attempts, and domain-specific threat inputs. FinProof covers 14 BFSI-specific categories (B-01–B-14).
- Ongoing monitoring: instrument the output classification layer for threat category rates, regulatory violation frequencies, and hallucination proxies — not just model-level metrics.
A governance framework that extends SR 11-7 this way is defensible to a regulator examining a GenAI deployment under current guidance.
The gap won't last
The Federal Reserve acknowledged in SR 26-2's Footnote 3 that GenAI guidance is coming. When it arrives, institutions with existing governance structures — documented pipelines, adversarial validation records, instrumented monitoring — will be better positioned than those that waited.
SR 11-7 is not sufficient. It is also what you have.
← Back to blog