Regulators Said Nothing About GenAI — That Doesn’t Mean Banks Are Off the Hook

On April 17, 2026, the Federal Reserve, OCC, and FDIC issued updated model risk management guidance (SR 26-2) — the first major update to the framework in 15 years. The guidance explicitly excluded generative AI and agentic AI models from its scope, stating they are “novel and rapidly evolving” and therefore outside the current framework.

According to Chris Stanley, banking industry practice lead at Moody’s, writing in American Banker, that exclusion is not a green light. The core argument: a bank’s existing risk management and governance practices must apply to any tool, process, or system — including those not covered by formal guidance.

The article identifies what Stanley calls the “governance gap” facing every financial institution — illustrated through three types of employees present in most organizations:

• One employee is using a personal AI tool on their work laptop without IT or compliance awareness — classic shadow AI exposure
• A second deployed the board-approved enterprise AI tool and moved on, assuming governance was handled at implementation
• A third is doing the actual work: questioning AI outputs, documenting deficiencies, and understanding how each output will reach a customer or shape a decision

Stanley argues that financial institutions are among the most heavily targeted by bad actors, and that the pace of AI adoption in adversarial contexts has already outrun traditional governance frameworks. The fact that regulators acknowledged AI’s rapid evolution as a reason to exclude it from formal guidance does not reduce the underlying risk — or an institution’s obligation to manage it.

The implicit message for enterprise AI practitioners: governance frameworks must scale to cover generative and agentic AI now, regardless of whether formal regulatory requirements have caught up.

Read the full article on American Banker