The GenAI Model Risk Gap: What Banks Should Do While the OCC AI RFI Is Still Being Written

TL;DR

• OCC Bulletin 2026-13 / SR 26-02 (April 17, 2026) replaced SR 11-7 but explicitly excluded generative AI and agentic AI from guidance scope
• The agencies promised an AI-specific RFI “in the near future” — as of June 2026, it has not been published
• “Excluded from scope” is not a compliance pass: OCC says banks must apply “broader risk management and governance practices” to GenAI tools
• NIST AI 600-1, the FS AI RMF’s 230 control objectives, and your existing MRM infrastructure are the interim playbook
• Build the GenAI governance program now; calibrate it when the formal guidance drops

On April 17, 2026, the OCC issued Bulletin 2026-13 and the Federal Reserve issued SR 26-02 — the long-awaited replacement for SR 11-7 and OCC Bulletin 2011-12. Banks finally had updated model risk management guidance. And right in the scope section, a carveout: generative AI and agentic AI were explicitly excluded. The agencies acknowledged the gap and promised to issue a request for information on AI model risk management “in the near future.”

It’s now June. The RFI hasn’t landed.

The OCC just handed your MRM team a framework that doesn’t cover the technology your CTO is most excited about. And the interim guidance is: wait for an RFI that has no published timeline. That’s not a governance program — that’s an audit finding waiting to happen. Don’t wait.

Why “Excluded from Scope” Is Not a Pass

It’s tempting to read the GenAI carveout as a gift. No formal requirements yet? Great — we’ll revisit when the guidance drops. That reading misses the explicit language the agencies included in the same bulletin.

The agencies wrote: “banking organizations should apply their broader risk management and governance practices to guide the determination of appropriate governance and controls to be applied to any tools, processes, or systems not covered by the Revised Guidance, including generative and agentic AI models.”

Read that carefully. GenAI doesn’t have a formal MRM framework yet, but it has your entire existing risk governance structure applied with judgment. The agencies aren’t saying GenAI is ungoverned — they’re saying you need to figure out how to govern it using what you already have, until they tell you more specifically.

The practical translation: when your examiner comes in and asks about your GenAI program, “it’s excluded from OCC 2026-13 scope” is not a complete answer. They will follow with: “What governance have you applied? What’s your risk assessment process? How are you monitoring outputs?” If you don’t have answers to those questions, you have a gap — even if there’s no formal citation for it yet.

The Orrick analysis of the interagency guidance overhaul makes this point clearly: banks should not interpret the GenAI exclusion as an invitation to pause governance work. The expectation of “broader risk management practices” is doing real work in that sentence.

The Deployment Reality

Banks aren’t waiting for the RFI to deploy GenAI. They’re already running it:

• Customer-facing chatbots handling account inquiries and complaint routing, powered by large language models
• Compliance assistants that summarize regulatory guidance and flag relevant changes for review teams
• Model validation support tools that draft initial challenge write-ups based on model documentation
• AI-generated board report drafts synthesizing financial performance data
• Internal knowledge management tools that answer employee questions about policy and procedure

Every one of these deployments sits outside OCC 2026-13 scope. None of them sits outside regulatory scrutiny. The risk isn’t that you’ll get an MRA tomorrow for deploying a GenAI chatbot without a formal validation report. The risk is that deployment velocity outruns governance maturity — and when the formal guidance lands, you’re not calibrating your existing program, you’re building from scratch under examiner scrutiny.

That’s exactly the dynamic that produced SR 11-7 in the first place. Banks deployed quantitative models faster than governance caught up, decisions got made with no documentation, no independent validation, no monitoring. Fifteen years of MRM buildout followed. Generative AI is on the same trajectory, compressed into a two-year window instead of a decade. The time to build governance infrastructure is before the formal requirement, not after the first MRA.

The Interim Framework: Three Components

You don’t need to wait for the RFI to build a defensible GenAI governance structure. Three existing resources give you enough to work with.

NIST AI 600-1 (Generative AI Profile)

NIST published the Generative AI Profile as a companion to the AI RMF 1.0, specifically addressing the risk categories that differentiate generative AI from traditional models. The 12 GenAI-specific risk categories are:

1. Confabulation (hallucination) — outputs that are plausible but factually incorrect
2. Data privacy — training data exposure and inference attacks
3. Harmful bias — discriminatory outputs from biased training data
4. Homogenization — convergent outputs reducing diversity and resilience
5. Intellectual property — copyright and attribution risk in generated content
6. Data provenance — uncertainty about training data sources and quality
7. Harmful output — generation of dangerous, illegal, or abusive content
8. Human-AI interaction — over-reliance, automation bias, and inappropriate trust
9. Information security — prompt injection, jailbreaking, adversarial inputs
10. Information integrity — misinformation amplification and synthetic content
11. Environmental impact — compute and energy costs at scale
12. Model obsolescence — capability drift as underlying models are updated

Each category maps to the four AI RMF functions (GOVERN, MAP, MEASURE, MANAGE), giving you a structured way to organize your controls and documentation. For a deeper look at how these categories apply in banking, see the post on NIST AI 600-1’s 12 GenAI risk categories.

FS AI RMF (Treasury, February 2026)

The Treasury Financial Services AI Risk Management Framework published in February 2026 gives you 230 control objectives specifically calibrated for financial institutions. This isn’t a generic AI framework retrofitted to banking — it’s built for the credit, payments, lending, and insurance contexts that actually matter for your exam.

The FS AI RMF’s value for interim GenAI governance is traceability. When an examiner asks where your controls came from, “Treasury FS AI RMF Control Objective 4.2.1” is a better answer than “we made these up.” The 230 control objectives give you citable structure that survives the question “what framework are you using?”

Your existing MRM infrastructure

The revised guidance didn’t abolish SR 11-7 principles — it updated them. Your model inventory process, validation documentation standards, governance committee structure, and ongoing monitoring frameworks are all still operative. They need to be extended to GenAI, not replaced.

The extension looks like this: your model inventory process now needs to cover GenAI systems. Your governance committee needs to be explicitly chartered to cover GenAI deployments. Your pre-deployment review process needs a GenAI variant with different validation criteria. The process is familiar; the metrics and methods are different.

For background on what changed with the SR 11-7 rescission and what carried forward, see OCC Bulletin 2011-12 and SR 11-7 Are Officially Rescinded.

Five Ways GenAI Governance Differs from Traditional MRM

The Databricks 2026 model risk management guide captures this well: GenAI governance isn’t model risk management with different vocabulary — some of the core methods are genuinely different. Here’s where the frameworks diverge:

The monitoring metric difference deserves special emphasis. Traditional model monitoring tracks things like score distribution shifts, default rate divergence, and feature drift — all quantitative, all tied to a known output variable. GenAI monitoring needs to track hallucination rate, citation accuracy, refusal rate, output toxicity scores, and prompt injection incidents. None of these appear in a traditional model monitoring dashboard. Build them into your monitoring framework from the start — retrofitting them after deployment is significantly harder.

What a GenAI Inventory Entry Should Include

Your model inventory is where GenAI governance becomes concrete. At minimum, each deployed GenAI system needs the following fields:

• System description: What LLM is being used (provider, version), what system prompt is in place, what data sources does the system access
• Use case: What decision or output does this system support? Is it customer-facing or internal? What actions can it trigger?
• Risk tier: High, Medium, or Low — based on customer impact, regulatory touchpoint (credit decisioning, adverse action, complaint handling), and output consequence (informational vs. actionable)
• Human review triggers: Under what conditions must a human review the output before action is taken? What’s the escalation path when the system flags uncertainty?
• Monitoring approach: What metrics are tracked, at what frequency, and who reviews them? What threshold triggers a review?
• Vendor documentation: For third-party AI systems — data processing agreement, model card, AI transparency disclosures, provider incident notification terms
• Last review date and owner: Who owns this system in the governance structure, and when was it last reviewed?

This inventory doesn’t replace formal validation for high-risk use cases — it creates a governance baseline showing the system is owned, documented, and monitored. That baseline is what an examiner is looking for before the formal GenAI MRM guidance gives them a specific checklist to run against.

Six Things to Document Before the RFI Lands

When the RFI arrives, it will ask banking organizations to describe their current practices as a baseline for developing requirements. That baseline response is dramatically easier to write if you’ve already built the program. Document these six things now:

1. GenAI inventory — Every deployed LLM system, including vendor tools like Microsoft Copilot, GitHub Copilot, and Salesforce Einstein. Keep this separate from your traditional model inventory — the fields are different and conflating them creates audit confusion.

2. Governance structure — Who approves new GenAI deployments? Who owns ongoing monitoring? Is your AI governance committee or model risk committee explicitly chartered to cover generative AI, or does it only reference “models” in the traditional MRM sense? Scope the charter explicitly.

3. Use case risk tiers — High (customer-facing decisions, regulatory-impacting outputs like adverse action letters or compliance certifications), Medium (internal productivity tools with human review), Low (purely internal, no customer or regulatory touchpoint). The tier drives the depth of documentation and oversight.

4. TEVV approach — Testing, evaluation, validation, and verification methodology for GenAI. This doesn’t need to be as formal as traditional model validation documentation, but it needs to exist. What pre-deployment testing was done? What adversarial or red-team evaluation was conducted? What ongoing quality checks are in place?

5. Vendor controls — What data leaves your organization when a GenAI system runs? What agreements govern that data? Have you reviewed the provider’s model card or AI transparency documentation? Have you evaluated the vendor’s security controls under your TPRM framework?

6. Incident log — Output errors, customer impacts, near-misses — with dates, severity assessments, and resolution documentation. When a hallucination reaches a customer, or a prompt injection attack is detected, or an output creates a compliance concern, that event needs to be logged. You cannot demonstrate effective monitoring without documented evidence that you respond to monitoring signals.

So What?

The formal GenAI model risk guidance is coming. The RFI will publish, the comment period will run, and eventually there will be a specific framework governing how banks validate, monitor, and document LLM deployments. That process will take twelve to eighteen months after the RFI drops, minimum.

“We’re waiting for guidance” isn’t a governance program — it’s an audit finding waiting to happen. The agencies told you exactly what to do in the meantime: apply broader risk management and governance practices. NIST AI 600-1 gives you the GenAI-specific risk taxonomy. The FS AI RMF gives you 230 traceable control objectives calibrated for financial services. Your existing MRM infrastructure gives you the process backbone. The only missing piece is documentation that demonstrates you’re actually doing it.

Build the GenAI governance program now. When the formal guidance lands, you’ll be calibrating your existing framework against new requirements — not building from scratch while an examiner watches.

For teams that want a pre-built starting framework, the AI Risk Assessment Template & Guide includes a pre-deployment checklist and vendor questionnaire adapted for GenAI use cases, a Shadow AI register, and eight worked examples across the use cases examiners are most likely to scrutinize — including customer chatbots, marketing GenAI, and credit underwriting AI.