Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsAI governance is the organization-wide system for deciding how an institution adopts, oversees, and controls AI. Model risk management (MRM) is the more focused discipline for managing risks from models and their use. MRM is part of a sound AI governance approach, but it does not cover every AI risk. That distinction matters especially under the revised U.S. banking guidance issued in April 2026: it covers traditional quantitative models and certain non-generative, non-agentic AI models, but expressly excludes generative and agentic AI models.
What is the difference between AI governance and model risk management?
AI governance sets the institution-wide direction and accountability for AI adoption and use. It considers which uses are appropriate, who oversees them, what safeguards are needed through the lifecycle, and how risks beyond model performance—such as cyber, information and communications technology (ICT), and third-party risks—are handled.
As an Amazon Associate I earn from qualifying purchases.
MRM focuses on risks arising from models and their outputs in the context of how they are used. It addresses matters such as assumptions, complexity, input quality, development, testing, validation, monitoring, documentation, and controls on use. Model approval alone is not the end of that work: a sound model can still create high risk if it is applied to the wrong purpose or misused.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →| Dimension | AI governance | Model risk management |
|---|---|---|
| Primary scope | Organization-wide direction and oversight of AI adoption and use | Risks from models and their outputs, assessed in the context of use and exposure |
| Main questions | Should the institution use this AI system, who is accountable, and what lifecycle safeguards and broader risk controls are needed? | Are the model’s assumptions, data, design, performance, and use adequately understood and controlled? |
| Lifecycle focus | Strategy and adoption as well as development, deployment, use, monitoring, and oversight | Model development and use, testing, validation, monitoring, governance, and controls |
| Coverage boundary | Can address AI uses and risks beyond the revised U.S. banking guidance’s model definition | The 2026 U.S. interagency guidance excludes generative and agentic AI models |
| Relationship | Provides the wider operating and oversight environment for AI | Supplies model-specific policies, roles, controls, validation, and monitoring within that environment |
In practice, an institution can treat MRM as one specialist control system within a wider AI governance structure. That structure must also decide how to manage AI uses that are not models under the relevant guidance, and risks that do not reduce to model accuracy or validation.
What changed in U.S. banking guidance in 2026?
On April 17, 2026, the Federal Reserve, Office of the Comptroller of the Currency (OCC), and Federal Deposit Insurance Corporation (FDIC) issued revised interagency model risk management guidance. The Federal Reserve’s SR 26-2 letter says the revision supersedes and replaces SR 11-7 and SR 21-8. The prior SR 11-7 guidance should therefore not be described as the current interagency guidance.
The revised approach is risk-based and tailored to an institution’s model risk profile and the size and complexity of its operations. It is supervisory guidance, not an enforceable or prescriptive rule. The guidance says that non-compliance alone will not result in supervisory criticism; however, violations of law or unsafe or unsound practices remain separate grounds for supervisory action. A non-prescriptive framework does not remove an institution’s other legal or safety-and-soundness obligations.
Rank #2
Which organizations should pay attention?
The agencies identify banking organizations with more than $30 billion in total assets as those for which the guidance is expected to be most relevant. That figure is an applicability marker, not a universal cutoff or automatic exemption. Smaller organizations may also find it relevant if they have substantial model-risk exposure—for example, because their models or activities are unusually prevalent or complex, or because they operate beyond traditional community banking.
Free tools Windows power users keep installed
One-click scans. No signup required.
Which systems count as models?
The guidance defines a model as a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to input data to produce quantitative estimates. It excludes simple arithmetic, deterministic rule-based processes, and software whose design or use is not underpinned by those theories. It covers traditional statistical and quantitative models as well as non-generative, non-agentic AI models.
Rank #3
Does SR 26-2 apply to generative AI?
No—not as a model under this revised guidance. Generative and agentic AI models are expressly outside its scope. That boundary does not mean banks should leave those systems unmanaged: the agencies say broader risk management and governance practices should guide appropriate controls for tools and systems the guidance does not cover. Institutions may therefore need AI governance controls for generative and agentic systems even where this particular MRM guidance does not apply.
What should an MRM program cover?
The revised guidance discusses development and use, testing, validation and monitoring, governance and controls, and third-party products. It calls for clear responsibilities across the model lifecycle, effective policies and procedures, an inventory that contains enough information to understand model risks, and adequate documentation.
- Development and use: Document the model’s purpose and relevant assumptions, data, and design, and assess it in the context of its actual and intended use.
- Testing, validation, and monitoring: Evaluate model soundness and performance, then monitor whether the model remains fit for purpose as conditions, data, or use change.
- Governance and controls: Assign clear lifecycle responsibilities, maintain policies and procedures, and keep documentation and inventory information sufficient to support risk oversight.
- Third-party products: Understand a vendor model’s conceptual soundness, design, development data, and performance; monitor its outcomes and continuing fitness for purpose rather than treating the vendor relationship as a substitute for oversight.
The amount of rigor should reflect materiality, use, exposure, and the institution’s circumstances. The guidance frames model risk in relation to inherent risk and materiality, including exposure and purpose. A model’s technical quality is only part of the assessment: consequences can also arise when users apply a model outside its intended setting or rely on outputs without appropriate controls.
What does broader AI governance add?
AI governance connects model controls to decisions across the organization: AI strategy, accountability, responsible adoption, lifecycle safeguards, and risks that cut across technology and business functions. The Financial Stability Board (FSB) illustrates this broader view in its June 2026 consultation, which proposes 12 sound practices for financial institutions. It groups them around organization-wide AI governance, risk management through AI development and deployment, and AI-related cyber, ICT, and third-party risk.
The FSB described the practices as a non-prescriptive toolkit, not an international standard. Its June 10, 2026 release said the practices cover “organisation-wide governance, as well as management of different stages of AI development and deployment.” The release quoted Michelle Bowman, Chair of the FSB Standing Committee on Supervisory and Regulatory Cooperation and Federal Reserve Vice Chair for Supervision, saying: “This report establishes clear safeguards for financial institutions to adopt, innovate, and use AI responsibly.” Those statements describe the consultation, not a binding requirement.
As of October 4, 2026, the FSB final report is not established here; the June consultation said a final report was expected later in October. Treat the 12 practices as proposals unless and until the final publication confirms their status and wording.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should a financial institution put the two together?
A practical design is to let AI governance set institution-wide expectations and route systems into the appropriate specialist controls. The following sequence is an implementation framework, not a prescribed procedure in either the U.S. guidance or the FSB consultation.
- Inventory AI uses and systems. Record the purpose, business context, accountable functions, provider or internal origin, and where and how each system is used. For systems that may meet the U.S. model definition, keep the information needed to understand their model risks.
- Classify scope before selecting controls. Determine whether a system is a model under the revised U.S. guidance, whether it is generative or agentic, and whether it falls outside the guidance’s model definition. Do not treat every AI system as an MRM model or assume that a system outside this guidance has no governance needs.
- Assess risk in context. Consider materiality, exposure, purpose, complexity, input quality, and the consequences of misuse. Scale controls to the institution and the model’s risk profile rather than applying the same validation burden to every use.
- Assign lifecycle accountability. Make responsibilities clear for development or procurement, approval, validation, deployment, user controls, monitoring, and escalation. The institution’s structure may vary, but responsibilities should not disappear at the boundary between a model team, business owner, vendor, or oversight function.
- Maintain oversight after deployment. Monitor performance and outcomes, changes in conditions and use, and third-party fitness for purpose. Establish a path for review or escalation when outcomes indicate that a model or AI use no longer fits its intended purpose.
- Cover risks MRM does not resolve. Use the wider AI governance framework to consider accountability and risks such as cyber, ICT, and third-party exposure, including for generative and agentic systems outside the revised MRM guidance.
Which framework is binding, and where?
The frameworks differ in both geography and legal character. The revised interagency MRM guidance is U.S. banking supervisory guidance. The FSB’s June 2026 material is an international consultation proposal. Neither should be presented as a universal, prescriptive global AI rule; the MRM guidance also states that it does not itself set enforceable standards. Institutions must assess their applicable legal obligations separately from these frameworks.
The useful dividing line is therefore not “AI governance or MRM.” AI governance answers for the institution’s overall approach to AI; MRM provides focused controls for in-scope models and their use. The revised U.S. guidance’s exclusion of generative and agentic AI makes the broader governance layer especially important, not optional by implication.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
