SR 26-2 (which superseded SR 11-7 in April 2026) places generative AI outside its scope, but says a bank's broader risk management and governance practices should still set the controls for such tools. Under the bank's internal AI risk program, how should a production LLM used for research summarization be treated?

SR 26-2, issued by the Federal Reserve, OCC and FDIC in April 2026 to supersede SR 11-7, covers traditional statistical models and non-generative, non-agentic AI. Its footnote 3 says generative and agentic AI are novel and rapidly evolving and therefore not within its scope, and adds that a banking organization's risk management and governance practices should guide the controls for tools the guidance does not cover. A production LLM therefore falls under the bank's broader AI risk program. Good practice there mirrors familiar lifecycle discipline: record the system in the inventory, tier it by use case and impact, test and evaluate it in proportion to that impact (summary accuracy and faithfulness, hallucination rate, data leakage), monitor output quality in production, and put prompt, model-version and vendor changes under change control. Treating it as 'just text' ignores that analysts act on these summaries, and that errors or leaked confidential data create real exposure. Reading the SR 26-2 exclusion as an exemption from all controls misreads the footnote, which points the bank to its own governance rather than to no governance. A well-known vendor logo is not evidence; reputation cannot substitute for testing against the bank's own use case. Exam caveat: do not answer LLM questions by citing SR 26-2 requirements; cite the firm's AI governance framework, which may borrow model risk techniques. In practice, check that the LLM appears in the AI inventory with an owner, a risk tier and a documented evaluation.