- Home
- AI agents
- Governance and regulation
- Model risk for banks and insurers
Govern and secure · Governance and regulation
How does model risk management apply to AI agents at banks and insurers?
Model risk management is how banks and insurers inventory, validate and monitor the models behind business decisions. For AI agents it applies unevenly in 2026: US bank guidance SR 26-2 leaves generative and agentic AI out of scope, while UK, Singapore, US insurance and EU rules reach agents through other routes.
In this guide: 83 pages
Key takeaways
- SR 26-2 (17 Apr 2026), issued jointly by the Federal Reserve, OCC and FDIC, replaced SR 11-7 and SR 21-8. Footnote 3 puts generative and agentic AI models outside its scope and says a bank’s broader risk management and governance practices should decide the controls for them.
- The traditional models an agent calls stay in scope. A statistical credit or hardship score that an agent invokes as a tool is still a model under SR 26-2, and using it beyond its validated purpose is a risk the guidance names.
- The PRA’s SS1/23 applies to models used for business decisions regardless of technology, vendor models included, at UK banks with internal model approval. Its current version took effect on 23 Apr 2026.
- Insurers face principles rather than an exclusion. The NAIC Model Bulletin (adopted 4 Dec 2023) expects a written AI program covering every lifecycle phase, third-party systems included, and EIOPA’s Opinion (6 Aug 2025) sets expectations for AI that is neither prohibited nor high-risk under the EU AI Act.
- Annex III of the EU AI Act lists as high-risk the AI systems used for credit scoring of people, fraud detection excepted, and for risk assessment and pricing in life and health insurance, subject to the classification rules in Article 6. Those duties apply from 2 Dec 2027.
What does SR 26-2 say about AI agents?
It puts them out of its scope. Footnote 3 of the attachment reads: "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance." The same footnote adds that a bank’s risk management and governance practices should still decide the controls for any tools and systems the guidance does not cover.
Read the rest of the guidance before you file agents as somebody else’s problem. SR 26-2 is expected to be most relevant to banks with over 30 billion dollars in total assets, and it sets no enforceable standards, though supervisory action can still follow from unsafe or unsound practices. Its definition of a model is narrow: a complex quantitative method that applies statistical, economic or financial theories to turn input data into quantitative estimates. It excludes simple spreadsheet arithmetic and deterministic rule-based processes with no statistical, economic or financial theory behind their design or use.
The concepts still travel. SR 26-2 judges model risk by inherent risk, exposure, purpose and use, and treats exposure plus purpose as materiality. It asks for effective challenge: critical analysis by people with the expertise, independence and organisational standing to force a change. Internal audit evaluates whether model risk management works rather than repeating the validation. Section VII expects a bank to understand a vendor model’s design, development data and performance and to keep monitoring it, even when the vendor withholds code or data, which is the right posture for a hosted language model behind an agent.
Which parts of an agent fall inside model risk management, and which fall outside?
Split the agent into its parts and the answer becomes clear: the generative model and the agent built around it sit outside SR 26-2, and any traditional quantitative model or non-generative, non-agentic AI model it calls sits inside when it meets the guidance’s definition. Pure rules engines and systems of record fall outside that definition.
The parts of a typical banking agent and where each one is governed, reading SR 26-2 as published on 17 Apr 2026.
| Part of the agent | Inside SR 26-2? | How to govern it |
|---|---|---|
| The language model, hosted or open weights | No, footnote 3 | Third-party risk management, provider retirement dates, evaluation on your own tasks |
| The agent itself: instructions, plan, memory, tool choices | No, footnote 3 | Registry record, risk tier, independent evaluation, approval gate, tracing |
| A credit, fraud, pricing or hardship model the agent calls | Yes, as a traditional quantitative or non-generative, non-agentic AI model | Existing validation, outcomes analysis and monitoring; record the agent as a new user of the model |
| A vendor scoring model behind an API | Yes, under section VII on vendor and third-party products | Vendor validation and ongoing monitoring, as for any vendor model |
| A deterministic business rules engine | No, when no statistical, economic or financial theory underpins it | Change management and testing |
| The core banking or policy administration system | No, a system of record | Access control, least privilege for the agent identity, audit logging |
The third row deserves the most attention. SR 26-2 says that using a model beyond its intended purpose introduces additional uncertainty and risk. An agent that calls a hardship score while drafting a collections message, or a fraud score while answering a customer, may be doing exactly that, and model validation will not know unless the agent registry links to the model inventory.
How do UK, Singapore and EU rules reach agents?
They reach agents through technology-neutral scope or through the use case. The PRA’s principles apply regardless of technology, MAS names AI agents in its scope, and the EU AI Act classifies a system by the decision it supports.
- PRA SS1/23 (UK) has five principles: model identification and model risk classification, governance, model development, implementation and use, independent model validation, and model risk mitigants. It covers models used to inform business decisions "regardless of technology", vendor models included, at banks, building societies and PRA-designated investment firms with internal model approval for credit, market or counterparty credit risk. A sub-principle covers the risks of artificial intelligence in modelling techniques such as machine learning. The original took effect on 17 May 2024 and the current version on 23 Apr 2026.
- The MAS Guidelines on AI Risk Management (Singapore, final 7 Oct 2026) apply to financial institutions, banks and insurers alike, and include "AI agents (including multi-agent systems)" in scope. They expect an accurate inventory and risk materiality assessment within 12 months and full implementation within 24, with monitoring that extends to reasoning processes, actions taken and tools used.
- The EU AI Act lists in Annex III point 5 the evaluation of creditworthiness or credit scoring of natural persons, except systems used to detect financial fraud, and risk assessment and pricing for natural persons in life and health insurance. After the Digital Omnibus those high-risk obligations apply from 2 Dec 2027, and the Commission’s draft guidelines of 19 May 2026, as reported by Covington, assess agentic systems as a whole.
What do insurance supervisors expect from an insurer’s agents?
They expect a written program that governs AI over its whole life, AI bought from vendors included, with documentation the supervisor can ask for. The NAIC Model Bulletin sets this out for US insurers, and EIOPA’s Opinion explains the same expectations to EU supervisors.
The NAIC Model Bulletin on the use of artificial intelligence systems by insurers, adopted on 4 Dec 2023, expects each insurer to develop, implement and maintain a written AIS Program for AI systems that make or support decisions related to regulated insurance practices. The program covers governance, risk management controls and internal audit, places responsibility with senior management and runs from design, development and validation through use, ongoing monitoring, updating and retirement, whether the insurer or a vendor built the system. Supervisors may request the documentation, including assessments of drift, traceability and auditability. The bulletin applies in each state that adopts it; we did not verify the current list.
EIOPA’s Opinion on AI governance and risk management (6 Aug 2025) is addressed to national supervisors and sets no new requirements. It explains how existing insurance law, including Solvency II and the Insurance Distribution Directive, applies to AI systems that are neither prohibited nor high-risk under the AI Act, and it names data governance, record-keeping, fairness, cybersecurity, explainability and human oversight as the elements to cover.
For an agent that triages claims or drafts letters to policyholders, that means the same register, owner and evaluation evidence a bank keeps, plus a record of which decisions the agent touched and how a person reviewed them.
How do you adapt model risk practice for an agent?
Keep the discipline and change the tests. Inventory, materiality, effective challenge, outcomes analysis and ongoing monitoring all have agent equivalents, so a bank or insurer that already runs model risk management has most of what it needs.
- Inventory: link each agent registry record to the model inventory entries of every model it calls, so a change on either side triggers a review.
- Materiality: tier each agent by the decision it influences and the exposure behind it, the two factors SR 26-2 uses for models.
- Effective challenge: have people outside the build team run the evaluation, with a golden dataset, several runs per case and a red-team pass, and give them the authority to block a release.
- Outcomes analysis: compare agent outputs with what happened next, such as overturned decisions, complaints or reopened cases, and track the rate per agent version.
- Ongoing monitoring and vendor oversight: trace every run, score a sample online, and rerun the regression suite whenever the provider changes or retires the model.
How do Microsoft, AWS and Google implement it?
Platform features a model risk team can use as evidence, as the vendor pages showed them on 2 Nov 2026.
Capability, Microsoft, AWS, Google
| Capability | Microsoft | AWS | |
|---|---|---|---|
| Agent inventory with owners | Agent 365 registry, generally available 1 May 2026, exportable for the model risk inventory | AWS Agent Registry, generally available 31 Aug 2026, with approval states | Agent Registry, generally available 18 Jun 2026 |
| Evaluation runs a validator can review | Foundry evaluations; the evaluation GitHub Action reports confidence intervals (preview) | AgentCore Evaluations, generally available 31 Mar 2026 | Gen AI evaluation service; its new GenAI Client SDK is in preview |
| Model version pinning and retirement | Foundry versionUpgradeOption; an 18-month lifecycle for most generally available models | Bedrock Active, Legacy and End-of-Life states for models launched from 7 Sep 2026 | Per-model discontinuation dates in the release notes |
None of these features is a validation in itself. They produce the records your validators and auditors review.
Frequently asked questions
Is SR 11-7 still the US guidance for model risk?
No. SR 26-2 superseded SR 11-7 and SR 21-8 on 17 Apr 2026. A bank that tells a supervisor it follows SR 11-7 for its agents is citing retired guidance, and SR 26-2 itself puts generative and agentic AI outside its scope.
If agents fall outside SR 26-2, does a bank still need to validate them?
Yes, in substance. Footnote 3 says the bank’s risk management and governance practices should decide the controls for systems the guidance leaves out, and supervisors can still act on unsafe or unsound practices. The practical route is to reuse the model validation team and its methods, adjusted for agents.
Is a claims-handling agent high-risk under the EU AI Act?
Not through Annex III point 5 alone, which names risk assessment and pricing in life and health insurance, and credit scoring, rather than claims handling. Other Annex III points or Annex I can still apply, and the Commission’s draft guidelines assess agentic systems as a whole, so check the full use with counsel.
Who should validate an AI agent at a bank?
Someone who meets the SR 26-2 test for effective challenge: the expertise to judge the agent, enough independence from the builders to stay objective, and the standing to force a change. In practice that is often the model validation function, with the security team running the red-team part.
More in Governance and regulation
Sources
Each source was read on 2 November 2026. The date shown is the date on the page, or the page’s ms.date for Microsoft Learn; an undated page shows the date it was read.
- SR 26-2: Revised Guidance on Model Risk Management
- Supervisory guidance on model risk management (SR 26-2 attachment)
- SS1/23 Model risk management principles for banks
- Guidelines on Artificial Intelligence Risk Management, response to feedback
- NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers
- EIOPA publishes Opinion on AI governance and risk management
- EU AI Act, Annex III: High-risk AI systems
- Regulatory framework for AI
- EU AI Act update: the European Commission publishes draft guidelines on high-risk AI systems
- Foundry Models lifecycle and retirement
- Amazon Bedrock model lifecycle
- Evaluations for Amazon Bedrock AgentCore
Planning an AI program?
Talk to the team that builds it and runs it after launch.
- Built to SOC 2, HIPAA and GDPR standards
- EU AI Act-aligned delivery
- Microsoft Solutions Partner