AI shared responsibility for financial services

Why adoption stalls. The blocker is rarely the model. It is that an autonomous system can produce text, make a decision, or execute a transaction, and no one has written down who owns the outcome at each step. The Federal Reserve, OCC, and FDIC issued SR 26-2 in April 2026, directing institutions to apply existing MRM principles by materiality while placing generative and agentic AI out of scope. So the standard is named, but the accountability map is left to each institution to draw, and until that map exists risk committees default to no. SR 26-2 supersedes SR 11-7 (2011) and SR 21-8 (2021) as the governing model risk management standard for Federal Reserve-supervised institutions. Read the letter ↗

What the schema provides. Each control in this schema maps an SRF layer to a specific MRM lifecycle stage (development, independent validation, ongoing monitoring, effective challenge), names the accountable persona, and specifies the OCSF telemetry stream that proves the control is functioning. The same schema applies to a community bank and a GSIB; only the tier parameter table differs.

Mapping status. The schema targets five crosswalks: SR 26-2, FINOS AIGF, CSA AICM, OWASP LLM Top 10, and the EU AI Act. OWASP mappings are populated where applicable; SR 26-2, FINOS AIGF, AICM, and most EU AI Act entries are marked TBD pending verification against the source documents. OCSF evidence pointers are verified for 13 of 40 controls; the rest are marked TBD. The controls browser shows only verified mappings.

Agent-PaaS coverage. All 40 controls apply to Agent-PaaS deployments, which carry the largest surface area under SR 26-2's by-analogy application of MRM principles. L3 and L4 controls address agent authorization gates, memory store integrity, guardrail bypass monitoring, and runtime verification: the controls SR 26-2 would require if agentic AI were explicitly in scope.