SR 26-2 and the Agentic Governance Gap The Aether Vector Podcast | AI Ethics, Policy, and Governance Series
On April 17, 2026, the Federal Reserve, the OCC, and the FDIC issued SR 26-2, the first revision to model risk management guidance in fifteen years. For banks, model risk teams, and board risk committees, SR 11-7 had become more than a regulatory document. It became the professional grammar of model risk management, giving practitioners language, process, and evidence standards that shaped an entire operating discipline.
SR 26-2 keeps the core obligation but changes the register. Materiality becomes the organizing principle. The burden shifts from pointing to process to defending judgment. Annual revalidation as the default is no longer the center of the operating model. Under the old regime, a model risk team could point to a completed process. Under this one, the better question is whether the process was the right one for the risk. That is a harder standard, and it requires sharper judgment, better evidence, and a tighter connection between technical practice and institutional consequence.
The most consequential part of SR 26-2 may not be what it governs. It may be what it deliberately leaves out.
Generative AI and agentic AI are outside the scope of the guidance. Not because the agencies are blind to these systems. Not because they are low risk. Because they are moving too fast for this guidance to prescribe them cleanly. A separate Request for Information is coming. The period between now and that next step is a design interval, not a waiting period. That is the inflection point this episode is built around.
Host Lewis V. Adams, Managing Director of The Aether Vector, brings more than twenty years inside regulated financial institutions to a practitioner-level reading of SR 26-2. He has built governance frameworks inside the institutions this guidance targets, and that inside perspective runs through every segment.
The episode opens with the fact pattern, then moves into the carveout in depth. Out of scope does not mean outside supervision, consumer protection, or internal risk management. Lewis walks through the adjacent framework stack, including the EU AI Act, NIST AI RMF, NAIC model bulletin, and OSFI E-23, and uses a concrete underwriting assistant scenario to show how a system outside the narrower model definition can still shape credit judgment, frame exceptions, and influence decisions without anyone formally governing the prompt, the retrieval source, or the override path. The governance questions that follow are operational, not theoretical: who approved the prompt, who monitors retrieval sources, who logs overrides, and who can stop the tool.
From there, the episode works through SR 26-2 as architecture rather than checklist, extending its four organizing principles into the carveout class. Two proprietary frameworks anchor the operating argument: Quant Human, a leadership model for keeping humans meaningfully in the room when agentic systems compress the distance between model output and consequence, and the Triple Guardrail Framework, which makes governance operational across Data, Model, and Market control layers at decision time rather than after the fact.
The closing segment lays out a concrete build agenda for boards, Chief Risk Officers, and operators. Institutions that build now, build under principles. Institutions that wait, build under prescription, and prescription typically arrives after something breaks publicly.
A written practitioner read and companion assets are available at TheAetherVector.com.
