Why SR 26-2 Excluded Generative AI── Traditional model validation does not work for generative AI — the Fed, Japan's FSA and the EU are each building new governance from different starting points

01SR 26-2 placed generative AI outside its scope

On April 17, 2026, the Federal Reserve, OCC and FDIC jointly issued SR 26-2, the first comprehensive revision of model risk management guidance since SR 11-7 was published on April 4, 2011. The new guidance also supersedes SR 21-8 (2021). SR 26-2 defines a model as "a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates," explicitly excluding simple arithmetic calculations and deterministic rule-based processes. It introduces a materiality construct that allows banks to calibrate the depth and frequency of validation to a model's risk significance, and is expected to be most relevant to banking organizations with over $30 billion in total assets.

Generative AI and agentic AI, however, are named as out of scope. The guidance states that these technologies are "novel and rapidly evolving" and directs institutions to govern them under their existing risk management practices. In other words, for the technology that is spreading fastest across financial services, no unified federal validation standard yet exists.

02Traditional model validation relied on comparing predictions to outcomes

SR 11-7 established a three-pillar validation framework: evaluation of conceptual soundness, ongoing monitoring of model performance, and outcomes analysis. For a credit scoring model, validation means comparing predicted default rates against actual defaults and verifying that the gap stays within tolerance. The framework assumes that a correct answer can be defined and that model outputs are deterministic — the same inputs produce the same outputs.

SR 26-2 retains this structure while adding flexibility through the materiality concept. High-materiality models receive deep, frequent validation; lower-materiality models may be validated more lightly. Traditional AI and ML models — classifiers for fraud detection, regression models for credit risk — fit within this framework because their inputs and outputs map to measurable quantities.

03Generative AI breaks validation because no single correct answer exists

The technical reason generative AI was excluded from SR 26-2 is that the premises of conventional validation do not hold. Generative AI produces unstructured outputs — text, images, code — and returns different results each time for the same input due to temperature parameters and sampling. Three specific difficulties arise.

First, outputs are non-reproducible. The same prompt sent to the same model can yield different text on each call. Second, detecting hallucinations requires cross-referencing against an external knowledge base, and the accuracy of that cross-reference itself becomes a validation target — a recursive problem. Third, models with tens or hundreds of billions of parameters make it practically impossible to trace why a specific output was generated.

04Japan's FSA covers AI under eight model risk principles without exclusion

Japan's Financial Services Agency published its Principles for Model Risk Management in November 2021. The eight principles cover governance, model identification and inventory management, model development, model approval, ongoing monitoring, model validation, vendor models and external resources, and internal audit. Unlike SR 26-2, the principles contain no language excluding AI or ML models from their scope.

In December 2024, the FSA released a Progress Report reviewing three years of dialogue with covered institutions. All target institutions had completed the construction of their model risk management frameworks and moved into the phase of operationalizing model lifecycle management. However, progress varied across institutions in registering AI and ML models in inventories and assigning risk ratings, and the question of how to classify externally provided large language models remained unresolved.

05The EU AI Act mandates explainability and human oversight for high-risk AI

The EU AI Act (Regulation (EU) 2024/1689) classifies AI used for creditworthiness assessment and credit scoring, as well as AI used for risk assessment and pricing in life and health insurance underwriting, as high-risk under Annex III. Providers of high-risk AI must comply with Article 9 (risk management), Article 10 (data governance), Article 13 (transparency), and Article 14 (human oversight). Article 13 requires providing users with sufficient information to understand the meaning of outputs — not full disclosure of internal model architecture.

The Digital Omnibus (Regulation (EU) 2026/1744) postponed the application of high-risk obligations to December 2, 2027, though prohibited practices (Article 5, February 2025) and general-purpose AI obligations (August 2025) are already in force. The practical question for financial institutions is how to satisfy Article 13 transparency when a large language model is embedded in the credit scoring pipeline. Traditional statistical models can show variable contributions; once an LLM enters the intermediate processing, the explanation path breaks.

06Pharmaceutical AI validation faces the same structural problem

The challenge of model risk management is not unique to finance. In January 2026, the FDA and EMA jointly published ten guiding principles for good AI practice across the medicines lifecycle. The principles call for risk-proportionate validation, clear definition of context of use, data governance, lifecycle performance monitoring, and transparent communication of AI limitations.

The validation structure that SR 26-2 requires for traditional models and the structure that the FDA-EMA principles require for pharmaceutical AI are similar. Both ask whether a model maintains acceptable performance for its intended use. The difference lies in the consequences: in finance, a flawed credit decision causes economic loss; in pharmaceuticals, a flawed quality or safety assessment can affect patient health. But the methodological challenges — defining correctness, ensuring reproducibility, detecting drift, providing explanations — are shared across domains.

07Three practical steps for governing generative AI models now

SR 26-2's exclusion of generative AI does not mean validation is unnecessary. The guidance directs each institution to govern generative AI under its existing risk management practices, which means building a bespoke framework.

First, extend the model inventory to include generative AI. The FSA's Principle 2 on inventory management applies directly. Record the use case, input data types, downstream consumers of outputs, accountable owner, and update frequency. For externally provided large language models, include contractual provisions for version-change notification and impact assessment.

Second, design multi-axis quality evaluation criteria. Since no single correct answer exists, measure quality along several dimensions: factual accuracy, absence of prohibited expressions, format compliance, and alignment with user intent. Define pass/fail thresholds for each axis and conduct periodic sample evaluations. In practice, a combination of human reviewers and automated checks by a separate model is becoming standard.

Third, embed human judgment records into business processes. Even if the internal workings of a generative AI model cannot be explained, the reason a human chose to adopt or reject its output can be documented. Article 14 of the EU AI Act requires human oversight — not explainability of the model itself, but a structure in which humans can understand, and when necessary override, model outputs.