A global asset manager is building an enterprise AI model inventory aligned with the model risk principles of SR 26-2 (which superseded SR 11-7 in April 2026) and with EU AI Act obligations. Their Chief Risk Officer asks what the MINIMUM set of metadata fields should be captured for each model entry. Which combination best supports both frameworks?

SR 26-2, the April 2026 Federal Reserve, OCC and FDIC guidance that superseded SR 11-7, describes a model inventory as a comprehensive set of information about models in development or use, with enough detail to understand model risk individually and in aggregate. It is written for banking organizations, but asset managers widely use it as the benchmark for model governance. It does not prescribe a schema, so the fields come from what a reviewer needs: purpose and business use, owner or vendor, inputs and outputs, materiality or risk tier, and validation status. The EU AI Act adds a second lens by classifying AI systems by risk level; uses such as creditworthiness assessment of individuals are high-risk and carry documentation, data governance and human oversight duties. The detailed entry covers both: use case, inputs, outputs and last validation date serve model risk review, vendor identifies third-party dependence, and risk tier plus regulatory classification serve the AI Act. Model name, deployment date and developer name tell a reviewer nothing about what the model does or whether it was validated. Programming language, cloud host and inference cost are IT asset and cost data, not risk data. Training-set accuracy and a repository link are developer artifacts; in-sample accuracy is not validation evidence and a link is not documentation. Exam caveat: SR 26-2 is non-binding and scales detail to model complexity and materiality. In practice, wire the inventory to validation workflows so a high-tier entry triggers review automatically.