The Fed examiner arrived at Acme Bank on Tuesday and asked a question the MRM team had not rehearsed: "Walk us through how SR 11-7 covers the Claude 4 fine-tune you deployed in February for the adverse-action letter workflow: model identification, validation evidence, governance artifacts, ongoing monitoring." The MRM lead pulled up the bank's model inventory. Twelve hundred rows of regressions, gradient-boosted credit-score models, and ALM/Treasury Monte Carlos. Zero rows for the Claude 4 deployment. Zero rows for the loan-default outreach agent that had been live for six weeks. The examiner waited. The MRM lead admitted what every U.S. and UK bank's second line of defense is discovering in 2026: the 2011 Model Risk Management framework that survived two financial crises was not designed for a non-deterministic generative model whose system prompt changes weekly, whose RAG corpus drifts daily, and whose foundation model can be silently upgraded by Anthropic without a single line of internal code changing. Lesson 067 is the adaptation playbook: how Federal Reserve SR 11-7 (2011), OCC Bulletin 2011-12, and PRA SS1/23 (May 2023) translate to LLMs and agents in 2026, what counts as the "model" when prompts and tools and memory are first-class components, the three lines of defense applied to generative systems, the tiering matrix that decides validation intensity, and the cross-walk that lets one risk register satisfy SR 11-7, SS1/23, and EU AI Act Article 9 simultaneously.

SR 11-7, OCC 2011-12, and PRA SS1/23 - What the Frameworks Actually Require

Three supervisory documents anchor the 2026 Model Risk Management (MRM) conversation for regulated institutions. SR 11-7, issued by the Federal Reserve in April 2011, became the de facto global standard. OCC Bulletin 2011-12, issued the same day, mirrors SR 11-7 in substance for national banks and federal savings associations. PRA SS1/23, issued by the Bank of England Prudential Regulation Authority in May 2023 with implementation by 17 May 2024, modernised the UK posture and explicitly anticipated generative AI without naming it.

SR 11-7's three pillars. The 2011 guidance organised model risk management around three pillars that every U.S. bank validation function still recites in onboarding. Pillar 1: robust model development, implementation, and use. Models must be developed with sound methodology, documented theory, evidence-based assumptions, rigorous testing, and clearly defined intended purpose. Implementation in production must replicate development behaviour; user training must ensure appropriate use; ongoing monitoring must detect performance degradation. Pillar 2, sound model validation. An effective challenge function independent of model development must verify the model is performing as expected, in line with design objectives and business uses. The validation must cover evaluation of conceptual soundness, ongoing monitoring, and outcomes analysis. Pillar 3: governance, policies, and controls. A board-approved model risk management framework, model inventory, defined roles and responsibilities, policies and procedures, and internal audit oversight. The three pillars are deliberately framework-level so they survive technology evolution, which is what 2026 is asking them to do for LLMs.

OCC Bulletin 2011-12 alignment. The OCC bulletin co-released with SR 11-7 and the two documents are read together for national banks. The OCC adds emphasis on the supervisory examination expectation, model risk is treated as part of operational risk and is subject to formal examination. A "Matter Requiring Attention" (MRA) at the model risk level is the warning that consent-order territory is one cycle away. The 2023-2024 OCC updates clarified expectations for AI/ML models, emphasising that the principle of effective challenge applies regardless of model type and that complexity does not reduce the validation requirement.

PRA SS1/23, five principles. The UK PRA's supervisory statement, effective 17 May 2024, restructured the guidance into five principles that are more explicit than SR 11-7 about the modern model landscape. Principle 1, model identification and model risk classification. Firms must maintain a comprehensive model inventory and assign each model to a risk tier based on materiality and complexity. Principle 2, governance. A model risk management framework approved by the board, with clear ownership of policies and standards. Principle 3: model development, implementation, and use. Development standards, implementation testing, and appropriate use controls. Principle 4, independent model validation. An independent validation function with the authority and resources to challenge models throughout the lifecycle. Principle 5, model risk mitigants. Compensating controls (human review, conservative buffers, segregation of duties) where model risk cannot be reduced through development or validation alone. The PRA was explicit that the framework covers all material models, including AI and machine-learning techniques, and the five-principle structure made the AI extension cleaner than SR 11-7's pillar-level abstraction.

2023-2024 supervisory letters and the 2026 reframing. Both Fed and OCC published interagency guidance updates and Dear CEO letters in 2023-2025 confirming that SR 11-7 applies to generative AI and large language models. The PRA followed with Dear CEO letters in 2024 and 2025 confirming SS1/23 expectations cover GPAI deployments. The 2026 reframing is operational, not regulatory, the framework was designed to be technology-agnostic, and the supervisors are now demanding banks demonstrate that the technology-agnostic framework actually operates against technology that did not exist when the framework was drafted. The gap is not in the rules; it is in the implementation.

What's Different About LLMs and Agents - The Twelve MRM Gaps Legacy Frameworks Don't Naturally Cover

The MRM playbook built for logistic regressions, gradient-boosted trees, and stochastic differential equation pricing models does not naturally cover the operating characteristics of generative AI. The adaptations below are the gap list every 2026 validation function works through.

Gap 1 - Non-deterministic outputs. A logistic regression produces the same probability for the same input every time. A large language model with sampling temperature 0.7 and top-p 0.95 produces a distribution of outputs. The validation question shifts from "is the output correct?" to "is the distribution of outputs acceptable across the input space?" Validation must measure output variance, define acceptable variance thresholds, and capture the inference-time hyperparameters (temperature, top-p, top-k, seed) as first-class model attributes. A model card that does not pin temperature and sampling configuration is not a complete model card.

Gap 2 - Emergent behaviour. Foundation models exhibit capabilities at scale that are not present at smaller scales. A 7B model that cannot reliably perform multi-step arithmetic becomes capable at 70B. The validation function must guard against capability surprise, a fine-tune or prompt change can unlock behaviour the validation suite was not designed to detect. Coverage gaps become risk surfaces.

Gap 3 - Prompt-as-code. The system prompt is the deterministic component of an LLM deployment. Changing the system prompt changes the model's behaviour as decisively as changing model weights. Yet most banks treat prompts as configuration rather than code: no version control, no review, no validation triggered by change. The adaptation is to treat system prompts as production code: versioned in git, peer-reviewed, validation re-triggered on change, and pinned to the model inventory row by hash.

Gap 4 - RAG dependencies. A retrieval-augmented generation deployment binds the model to an external corpus and a retrieval pipeline. The corpus drifts (documents added, removed, updated); the embedding model has its own version; the retrieval ranking has its own tuneable parameters. Validation must cover the corpus, the embedding model, the retrieval pipeline, and the chunking strategy as model components, not infrastructure. A RAG model card lists all four.

Gap 5 - Tool-use surface. An agentic system that can call tools (databases, APIs, code execution, payment systems) has a new attack surface and a new failure mode. Validation must enumerate the tool allowlist, define the allowed parameter ranges, test for tool misuse and tool hallucination, and capture human-in-the-loop checkpoints for high-impact tools. OWASP Agentic Top 10 (December 2025) provides the threat taxonomy; the MRM validation plan operationalises it.

Gap 6 - Memory state. An agentic system with persistent memory accumulates state that changes its behaviour over time. Memory poisoning becomes a validation concern. The validation function must define memory hygiene controls, what gets written, what gets read, what gets purged, what triggers a reset, and test the system under adversarial memory conditions.

Gap 7 - Agentic planning. Multi-step plans introduce a class of failure modes (goal drift, plan hallucination, recursive sub-agent spawning) that single-turn validation cannot detect. The validation plan must include end-to-end trace evaluation, plan-quality scoring, and timeout/iteration-limit controls.

Gap 8 - Foundation-model upgrades by upstream provider. When Anthropic upgrades Claude 4 to Claude 4.1, the bank's deployment changes underneath without a single line of internal code changing. EU AI Act Article 25(1)(a) substantial-modification logic cascades: if the upstream change is substantial, the downstream system inherits substantial-modification implications. The MRM framework must (a) detect the upstream change automatically via version polling, (b) trigger re-validation, (c) re-document, and (d) update the inventory row's vendor-version string. The 2024 Dear CEO letter from the OCC named this gap specifically.

Gap 9 - Hallucination measurement. Traditional model performance metrics (accuracy, AUC, MSE, RMSE) do not capture hallucination, the model confidently produces factually wrong output. Validation must measure faithfulness (does the output match the source material?), groundedness (does the output cite the right source?), and factual accuracy against benchmarks. RAGAS, TruLens, and the 2025-2026 generation of evaluators provide the tooling; the validation function must define acceptable thresholds and trigger re-training or system-prompt revision on regression.

Gap 10 - Benchmark gaming. Public benchmarks (MMLU, HellaSwag, HumanEval, BIG-Bench, HELM) leak into training data. A foundation model that scores 92% on HumanEval may have memorised parts of HumanEval. The validation function must (a) treat public benchmark scores as a lower bound on capability, (b) commission held-out internal benchmarks for high-stakes use cases, and (c) measure performance on production-distributed inputs rather than benchmark inputs.

Gap 11 - Refusal-appropriateness. A model that refuses too much is unusable; a model that refuses too little is unsafe. Validation must measure both over-refusal and under-refusal against a defined policy. Anthropic's published refusal-rate research and the XSTest benchmark provide reference points.

Gap 12 - Robustness under adversarial prompt. Prompt injection, jailbreak prompts, and adversarial suffix attacks (OWASP LLM Top 10 2025 LLM01) bypass guardrails. Validation must include red-team exercises against the deployed system, not just the foundation model, because the deployment context (system prompt, tools, memory, RAG corpus) creates attack surface the foundation-model evaluation does not cover. NVIDIA Garak and Microsoft PyRIT are the leading automated tools; manual red-team augments.

Three Lines of Defense, Model Tiering, and the Inventory Expansion

Translating SR 11-7 and SS1/23 to LLMs requires three operational structures: the three lines of defense applied to generative systems, a tiering matrix that decides validation intensity, and an expanded model inventory that captures the new components.

Three Lines of Defense (3LoD). The 3LoD model is the organisational chassis for SR 11-7 and SS1/23 implementation, and it maps cleanly to ISO 42001 A.3 (leadership) and A.4 (organisational structure). First line, the model owner / development team. Accountable for sound development, documentation, intended use, performance monitoring, and remediation. For an LLM deployment, the first line includes the prompt engineer, the RAG corpus owner, the eval suite owner, and the production engineer. Second line, Model Risk Management (the validation function). Independent of the first line, responsible for effective challenge, validation, ongoing monitoring oversight, and policy compliance. For LLM deployments, the second line must include skills in evaluation methodology, prompt analysis, adversarial testing, and statistical validation under non-determinism. Third line, internal audit. Periodic independent assurance over the operation of the framework. Reports to the audit committee of the board. The 3LoD discipline is what makes "effective challenge" enforceable; without independence, validation is theatre.

Model tiering matrix. SR 11-7 expects validation intensity to scale with model risk. SS1/23 Principle 1 makes the tiering requirement explicit. For LLMs and agents, the tiering matrix is a product of three axes: criticality (impact of a wrong output on the bank's financial, reputational, regulatory, or customer position); autonomy (the extent to which the model acts without human review: assistive, advisory, decisional, agentic); consumer impact (direct customer-facing impact, including fair-lending, discrimination, and consumer-financial-protection implications). The matrix yields four tiers. Tier 1, highest review intensity. Critical, decisional or agentic, direct consumer impact. Examples: credit decisioning agent, fraud-decision LLM, automated adverse-action determination. Annual validation, quarterly monitoring review, board-committee reporting, restricted change management. Tier 2. High criticality, advisory, consumer-facing. Examples: relationship-manager assistant for HNW clients, lending officer copilot. Annual validation, semi-annual monitoring review. Tier 3. Material but internal, assistive. Examples: internal-policy chatbot, employee productivity copilot with limited tool access. Biennial validation, annual monitoring review. Tier 4. Low criticality, no consumer impact, fully assistive. Examples: meeting summariser, document drafting helper. Validation by exception; monitoring via aggregate logs. The Acme Bank Claude 4 fine-tune for adverse-action letters is Tier 1 (consumer-impacting, decisional in tone even if a human reviews); the loan-default outreach agent is Tier 1 (consumer-impacting, agentic).

Model inventory expansion. The legacy MRM inventory schema (model ID, type, owner, validation status, last validation date, monitoring status) is necessary but not sufficient for LLMs. The expanded schema treats the following as components of "the model": (1) System prompt: versioned in git, hash-pinned to the inventory row, change history retained for the model retention period. (2) RAG corpus: corpus ID, version, refresh cadence, content-source list, provenance attestation, drift-monitoring threshold. (3) Embedding model: vendor, version, dimension, last update. (4) Retrieval pipeline: chunking strategy, retrieval-k, reranker, hybrid-search configuration. (5) Tools / functions: allowlist, per-tool parameter ranges, per-tool authentication scope, per-tool rate limits, per-tool human-in-the-loop requirements. (6) Memory store: schema, retention, write/read permissions, reset cadence. (7) Judge models, every LLM-as-judge component used in evaluation or guardrailing is itself a model and must appear in the inventory. (8) Eval suite: suite ID, version, coverage map, pass/fail thresholds, last run date and result. Each component has its own change-trigger that, when fired, triggers re-validation of the parent deployment. The 2026 PRA Dear CEO letter explicitly called out the system-prompt-as-component pattern as expected practice.

Worked Example - Acme Bank's Claude 4 Adverse-Action Letter Workflow and Loan-Default Outreach Agent

Concrete application removes ambiguity. Acme Bank, a $40B U.S. national bank with UK branch operations subject to PRA supervision, deployed two generative AI systems in early 2026 that triggered the MRM examiner conversation that opens this lesson.

System A - Claude 4 fine-tune for adverse-action letter drafting. Use case: when a credit application is denied, the bank must send the applicant an adverse-action notice under the Equal Credit Opportunity Act (ECOA) and Regulation B specifying the principal reasons for denial. The bank fine-tuned Claude 4 on 12,000 historical adverse-action letters approved by compliance, with the fine-tune objective of generating compliant, accurate, plain-language letters from the upstream credit-decisioning model's denial-reason vector. A human compliance officer reviews each letter before send.

MRM treatment: Tier assignment: Tier 1 (consumer-impacting, decisional in regulatory framing, direct discrimination risk). Model inventory entry, model ID acme.adverse-action-llm.claude-4-finetune.v1; foundation model Claude 4 (Anthropic, version pinned to claude-4-20260301); fine-tune corpus 12,000 letters with provenance attestation; system prompt v3.2 (hash pinned); no RAG; no tools beyond template insertion; no agentic behaviour; eval suite covering compliance accuracy, reason-faithfulness, plain-language readability, fairness across protected classes, refusal-appropriateness. Validation plan, independent validation by second-line MRM team: conceptual soundness (is fine-tuning the right approach versus template generation?); data-quality review (is the 12,000-letter corpus representative? is the compliance approval reliable?); benchmark testing on held-out letters (faithfulness, accuracy, fairness); adversarial testing (can prompt injection cause non-compliant letters?); ongoing-monitoring design (sample-based human re-review at 5% rate, fairness metrics by protected class monthly, drift detection on input-distribution). Monitoring KPIs, letter compliance pass-rate (compliance officer override rate; target <2%); fairness-rate parity across protected classes within 3pp; faithfulness score >0.95; refusal-rate <0.5%; drift on input-vector distribution within +/- 10% of baseline; vendor-version polling weekly with re-validation trigger on any Claude version bump. SR 11-7 Pillar mapping: Pillar 1 sound development (documented fine-tune methodology, eval design, intended-use statement); Pillar 2 effective challenge (independent second-line validation report); Pillar 3 governance (Tier 1 board-committee reporting, MRM policy compliance, change-control procedure).

System B - Agentic loan-default outreach. Use case: when a loan moves into early delinquency (30-60 days past due), an agentic system contacts the borrower via SMS, email, or scheduled call, attempts a structured conversation to understand the borrower's situation, offers hardship programs the borrower qualifies for, and escalates to a human servicer when the conversation indicates complexity, dispute, or vulnerability. Tools: SMS API, email API, scheduled-call API, hardship-program catalogue read, borrower-profile read (with consent-and-purpose scope), case-note write. Memory: conversation history per borrower, 90-day retention. Annex III §5(b) credit-scoring adjacency, the system does not score creditworthiness but it does drive consumer-financial decisions; Acme treats it as adjacent high-risk territory for the EU AI Act side and as Tier 1 for SR 11-7.

MRM treatment: Tier assignment: Tier 1 (consumer-impacting, agentic, fair-lending and CFPB-attention surface). Model inventory entry, model ID acme.collections-agent.claude-4.v2; foundation model Claude 4; system prompt v2.5; RAG corpus = hardship-program catalogue (15 documents, weekly refresh); tools allowlist as above with per-tool human-in-the-loop on escalation; memory store schema documented; judge models for vulnerability-detection and tone-quality scoring listed separately. Validation plan, conceptual soundness (is agentic outreach the right mode for collections? what is the fallback?); fair-lending validation across protected classes; vulnerability-detection sensitivity testing (does the model escalate when it should?); tool-misuse adversarial testing (can the model be tricked into making promises outside the hardship catalogue?); memory-poisoning testing; end-to-end agent-trace evaluation on 500 simulated conversations. Monitoring KPIs, escalation-rate by protected class (fairness); vulnerability-detection recall (target >95%); tool-call appropriateness rate; conversation-quality score; borrower-complaint rate; CFPB-complaint-themes scan. SS1/23 Principle mapping for the UK branch use of the same system: Principle 1 (Tier 1 classification); Principle 2 (board AI risk committee oversight); Principle 3 (development standards documented); Principle 4 (independent validation by MRM); Principle 5 (mitigants: human escalation, conservative tool scope, vulnerability-detection guardrail). Conservatism principle: given the novelty of agentic collections and the lack of established benchmarks, the validation report recommends a 12-month conservatism period with elevated human review (15% sample rate, dropping to 5% on demonstrated stability) and quarterly re-validation rather than annual.

Three Governance Artifacts - Policy, Inventory, Validation Standards

The SR 11-7 / SS1/23 implementation produces three governance artifacts that the examiner expects to read in any 2026 review.

Artifact 1 - Model Risk Policy (10-15 sections). Board-approved, owned by Chief Risk Officer, reviewed annually. Sections: (1) Purpose and scope (what is a model, including LLM/agent definition; what is in and out of scope). (2) Governance and roles (board, audit committee, CRO, CMO, MRM, internal audit, model owners). (3) Three Lines of Defense (responsibilities by line). (4) Model identification and inventory (schema, including LLM/agent expansion). (5) Model tiering (criteria, matrix, governance per tier). (6) Development standards (documentation, testing, intended-use). (7) Validation standards (reference to separate Validation Standards Document). (8) Implementation and change control (substantial-modification triggers, including vendor-version-change for GPAI dependencies). (9) Ongoing monitoring (metrics, cadence, thresholds, escalation). (10) Issue management and remediation (model risk findings, MRA tracking). (11) Vendor and third-party models (GPAI, foundation-model, fine-tune-as-a-service treatment). (12) AI-specific provisions (LLM/agent components as model parts; prompts as code; tools and memory as model surface). (13) Reporting (to board, audit committee, regulators). (14) Training and culture. (15) Policy maintenance and exceptions. The policy is the document the examiner reads first.

Artifact 2 - Model Inventory (extended schema for LLMs/Agents). The inventory is the system of record for every model, including LLM and agentic deployments, with the expanded schema described in the prior section. The inventory must be: (a) comprehensive (no model operates outside the inventory); (b) current (change events update it; the SDK pattern from governance platforms covered in lesson 020 is the only scalable approach for organisations with more than 30 LLM deployments); (c) auditable (change history, prior-state reconstruction); (d) cross-walked (one entry serves SR 11-7 model record, EU AI Act Article 11 + Annex IV technical-file pointer, ISO 42001 A.6.2 risk-treatment register entry, NIST AI RMF Map output). The PRA SS1/23 Principle 1 requirement is operationalised through the inventory; the OCC Bulletin 2011-12 model-inventory requirement is satisfied by it.

Artifact 3 - Validation Standards Document. Defines what counts as adequate validation for each model type. For traditional models, the document references existing standards. For LLMs and agents, the document must specify: (1) Conceptual soundness review for generative use cases (is generative the right approach? what is the comparison baseline?). (2) Data and corpus validation (training data, fine-tune data, RAG corpus, evaluation data). (3) Performance metrics under non-determinism (faithfulness, groundedness, refusal-appropriateness, fairness, robustness, distributional metrics across N samples). (4) Adversarial testing requirements (OWASP LLM Top 10, OWASP Agentic Top 10, MITRE ATLAS coverage matrix; Garak / PyRIT / Inspect tool requirements). (5) End-to-end agent evaluation (for agentic systems, trace-level evaluation, plan-quality scoring). (6) Benchmark interpretation (treating public benchmarks as lower-bound capability indicators; commissioning held-out internal benchmarks for Tier 1/2). (7) Vendor and foundation-model assessment (model card review, system card review, eval-harness review, third-party audit review where available). (8) Ongoing-monitoring design (KPIs, thresholds, cadence, drift detection, vendor-version-change trigger). (9) Conservatism (when model uncertainty is high or benchmarks are immature, layer human review and document the residual-risk acceptance). (10) Documentation and reporting (validation-report template, sign-off, retention). The validation function uses this document as its operating manual; the examiner uses it to evaluate whether the validation function is fit for purpose.

Cross-Walk to EU AI Act / NIST RMF / ISO 42001 - One Risk Register, Four Frameworks

The 2026 supervisory expectation is convergence. SR 11-7, OCC Bulletin 2011-12, PRA SS1/23, and the EU AI Act all expect a documented model lifecycle with independent challenge, governance oversight, risk classification, and ongoing monitoring. The efficient implementation is one risk register that satisfies all four; the inefficient implementation is four parallel registers that drift apart by the second annual audit.

EU AI Act cross-walk. Article 9 (risk management system): the SR 11-7 / SS1/23 risk register, with extension to fundamental rights for high-risk systems, satisfies Article 9. Article 11 + Annex IV (technical documentation), the model inventory entry plus the validation report plus the system prompt plus the eval suite documentation together form the Annex IV technical file. Article 17 (quality management system), the Model Risk Policy and the QMS share substantial overlap; firms with mature SR 11-7 / SS1/23 implementation can extend rather than rebuild for the EU AI Act QMS obligation. Article 25(1)(a) (substantial modification), the change-control procedure in the MRM framework operationalises substantial-modification re-conformity for AI systems, with the foundation-model-upgrade trigger explicitly captured. Article 26 (deployer obligations), for deployer-side use of GPAI, the monitoring obligation aligns with SR 11-7 ongoing monitoring. Article 27 (FRIA), for Annex III high-risk systems, the FRIA extends the SR 11-7 conceptual-soundness and impact-assessment artefacts to cover fundamental rights. The convergence is real; the implementation requires deliberate cross-walk design.

NIST AI RMF cross-walk. Govern 1.1 + 1.2 (governance and oversight), Model Risk Policy + board reporting. Govern 2.1 (roles and responsibilities), 3LoD definition. Govern 3.1 (workforce competence), MRM staff skills for generative validation. Govern 4.1 (organisational accountability), CRO accountability. Manage 1.1 + 1.2 (risk treatment), validation plan + ongoing monitoring. Manage 2.1 (incident response), issue management and remediation linked to Article 73 if EU exposure. The NIST functions map onto the SR 11-7 pillars without significant translation cost.

ISO 42001 cross-walk. A.3 (leadership), CRO + AI Officer roles. A.4 (organisational structure), 3LoD. A.5 (policy), Model Risk Policy. A.6 (lifecycle): development, validation, deployment, monitoring, decommissioning all captured. A.6.2 (risk treatment), inventory + validation report. A.7 (data governance), corpus and lineage. A.10 (third-party), vendor and foundation-model assessment.

2026 penalty exposure. A supervisory finding under SR 11-7 typically arrives as a Matter Requiring Attention (MRA) at examination, escalating to a Matter Requiring Immediate Attention (MRIA), and ultimately consent-order territory if uncorrected. Under PRA SS1/23, the equivalent escalation pathway runs through skilled-person review under section 166 of the Financial Services and Markets Act 2000, which is expensive (regulated firm pays the skilled person), public (the firm is named in the published PRA enforcement record), and operationally disruptive. Under EU AI Act Article 99(3), failures of Article 9 (risk management), Article 17 (QMS), or Article 26 (deployer obligations) carry administrative fines up to €15 million or 3% of worldwide annual turnover (whichever is higher). The convergence of regulator pressure, Fed, OCC, PRA, Commission, means firms that build the framework once and cross-walk it well are positioned for all four supervisory conversations. Firms that maintain parallel frameworks pay for the duplication and still face inconsistency findings.

Conservatism as principle. SR 11-7 includes the conservatism principle: when model uncertainty is high, layer additional controls (human review, conservative buffers, restricted use cases) and document the residual-risk acceptance. For LLM and agentic systems in 2026, where benchmarks are immature, public eval data leaks, and the technology is evolving, the conservatism principle is the right default. A Tier 1 LLM deployment that operates without human review, without elevated monitoring, and without restricted scope is hard to defend at examination. A Tier 1 LLM deployment with documented conservatism, elevated monitoring, and a published rationale for scope is the defensible posture.

Key Takeaways

• SR 11-7 (April 2011), OCC Bulletin 2011-12, and PRA SS1/23 (May 2023, effective May 2024) are the three anchor documents for Model Risk Management in 2026. SR 11-7's three pillars (sound development; effective challenge; governance) and SS1/23's five principles (identification + tiering; governance; development/use; independent validation; mitigants) are technology-agnostic; the 2023-2025 supervisory letters confirm they apply to generative AI and LLMs.
• Twelve gaps in legacy MRM that LLMs and agents expose: non-deterministic outputs, emergent behaviour, prompt-as-code, RAG dependencies, tool-use surface, memory state, agentic planning, foundation-model upstream upgrades, hallucination measurement, benchmark gaming, refusal-appropriateness, adversarial robustness. Each requires an explicit adaptation in development and validation standards.
• Three Lines of Defense map directly to ISO 42001 A.3 + A.4 and define the SR 11-7 / SS1/23 organisational chassis: 1L model owner / developer; 2L Model Risk Management (independent validation); 3L internal audit. Independence is what makes effective challenge real.
• Model tiering is a product of criticality x autonomy x consumer impact. Tier 1 (highest) = critical + decisional/agentic + direct consumer impact; annual validation, quarterly monitoring, board-committee reporting. Acme Bank's Claude 4 adverse-action workflow and loan-default outreach agent both land at Tier 1.
• The model inventory expansion for LLMs and agents treats eight items as components of "the model": system prompt (version-pinned), RAG corpus, embedding model, retrieval pipeline, tools/functions, memory store, judge models, eval suite. Each component's change triggers re-validation of the parent.
• Three governance artifacts are the examiner-facing deliverables: (1) Model Risk Policy (10-15 sections, board-approved); (2) Model Inventory (LLM/agent extended schema, current, auditable, cross-walked); (3) Validation Standards Document (what counts as adequate validation under non-determinism).
• The one-risk-register cross-walk satisfies SR 11-7, OCC 2011-12, PRA SS1/23, and EU AI Act Article 9 simultaneously. Article 11 + Annex IV technical file is assembled from inventory + validation report. Article 17 QMS overlaps Model Risk Policy. Article 25(1)(a) substantial-modification is the change-control procedure. Article 26 deployer obligation is operational monitoring. NIST RMF Govern 1.1/1.2/2.1/3.1/4.1 + Manage 1.1/1.2/2.1 map onto the SR 11-7 pillars; ISO 42001 A.3-A.6 + A.7 + A.10 map onto the same lifecycle.
• Penalty exposure converges in 2026. SR 11-7 escalation: MRA -> MRIA -> consent order. PRA SS1/23 escalation: skilled-person review under FSMA section 166, expensive and public. EU AI Act Article 99(3): up to €15M or 3% of worldwide turnover for Article 9, 17, 26 failures. The conservatism principle, layer human review and document residual-risk acceptance when model uncertainty is high, is the defensible posture for Tier 1 LLM and agentic systems where benchmarks are immature and the technology is moving.