SR 26-2 is U.S. banking model risk management guidance issued by the Federal Reserve, OCC, and FDIC in 2026. It tells supervised institutions to apply oversight that is proportional to the model’s risk, use case, and complexity, including models used for AI, analytics, credit decisions, fraud detection, and other automated controls.
It matters because models can fail quietly: bad training data, drift, weak assumptions, or hidden bias can produce wrong decisions at scale. In defense, SR 26-2 supports model inventories, independent validation, documentation, approval workflows, ongoing performance monitoring, and clear ownership. In real attacks or failures, the guidance helps banks spot manipulated inputs, data poisoning, unauthorized model changes, and degraded fraud or risk-scoring systems before they become losses or compliance issues.