US banks use SR 11-7 as the backbone, because examiners supervise against it, and the NIST AI RMF to widen it. SR 11-7 brings inventory, validation, effective challenge and monitoring. The AI RMF adds agent risks model risk teams can miss: harm to people, privacy, security against manipulation and generative AI failure modes.
What does each require?
SR 11-7, the interagency model risk guidance, expects banks to manage model risk through sound development, implementation and use; independent validation covering conceptual soundness, ongoing monitoring and outcomes analysis; and governance with policies, roles, an inventory and effective challenge. It is supervisory guidance that examiners from the Federal Reserve, OCC and FDIC apply.
The NIST AI Risk Management Framework 1.0 is voluntary. It organises AI risk management into four functions: Govern, which sets culture, policies and accountability; Map, which establishes context and identifies risks; Measure, which assesses and tracks them; and Manage, which prioritises and acts on them. It describes characteristics of trustworthy AI, including validity and reliability, safety, security and resilience, accountability and transparency, explainability, privacy and fairness with harmful bias managed. Its Generative AI Profile, NIST AI 600-1, extends it to risks specific to generative systems.
Who uses them?
Banks supervised by the Federal Reserve, OCC and FDIC must meet SR 11-7. Many also adopt the AI RMF to structure AI governance and to show a recognised framework when examiners ask about AI beyond classic models. Non-bank lenders often adopt both to satisfy bank partners. Which other federal and state laws apply is covered in which US laws apply to AI agents.
Why does an agent need both?
SR 11-7 asks whether a model is sound and used appropriately. An agent is usually a model in that sense; the reasoning is in is an AI agent a model under SR 11-7. But model risk practice developed around scorecards and pricing models, and three agent risks fall at the edge of its usual scope.
Harm to customers through action. SR 11-7 focuses on financial loss to the bank and poor decisions. An agent that closes accounts or sends collection notices can harm customers directly. The AI RMF's Map function asks explicitly about impacts on people and society.
Manipulation. Model validation rarely tests whether an adversary can steer a model through its inputs. For agents that read external documents, that is a central risk. The AI RMF's security and resilience characteristic, and the Generative AI Profile, bring it in scope.
Generative failure modes. Fabricated facts, inconsistent answers to the same question, and drift after a vendor update are covered by the Generative AI Profile in ways traditional validation templates are not.
How do you combine them?
Map each AI RMF function to SR 11-7 activities, then add what is missing.
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Govern; SR 11-7 governance | Model risk policy extended to agents; named owners; board reporting | Policy; owner register; board papers |
| Map; SR 11-7 inventory and intended use | Inventory entry per agent with capabilities, sources, actions and affected people | Inventory entries |
| Map: impacts on people | Impact assessment per capability that affects customers | Impact records |
| Measure; SR 11-7 validation | Independent testing on the bank's own cases, including adversarial inputs | Validation reports |
| Measure: trustworthiness characteristics | Tests for accuracy, fairness, privacy leakage and manipulation resistance | Test results by characteristic |
| Manage; SR 11-7 ongoing monitoring | Outcome monitoring with thresholds; restriction or withdrawal on breach | Monitoring reports; restriction records |
| Manage: use limits | Agent actions limited to validated scope at the moment of action | Permission map; refused actions |
| SR 11-7 effective challenge | Independent reviewers with authority to stop deployment | Challenge records |
| Generative AI Profile | Checks for fabricated facts, consistency and vendor model changes | Test results; change notices |
The inventory is where the two meet most usefully. A good entry records what SR 11-7 needs and what the AI RMF's Map function asks; our model risk inventory entry template for an AI agent gives a ready format. For the full SR 11-7 programme, see SR 11-7 model risk management for AI agents.
What will an examiner ask?
- Are your agents in the model inventory, and how are they tiered?
- How does validation address risks specific to agents, such as manipulation and actions?
- Do you use a framework for AI risk beyond SR 11-7, and how do the two fit?
- How do you detect changes in agent behaviour after a vendor model update?
- Who can stop an agent, and has that happened?
- How do you assess harm to customers from agent actions?
What do they not cover?
Neither is a law. SR 11-7 does not address fair lending, privacy or consumer protection directly; ECOA and Regulation B, GLBA and other laws do. The AI RMF does not prescribe controls or thresholds. Neither settles what an agent may do; that is a decision the bank makes and enforces. Our short answer on whether SR 11-7 applies to AI agents covers scope. For the full map, see AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
Pryme's Attest replays each agent capability against real cases from the bank's own operation, scoring every answer against a floor across seven gates, including scope, adversarial and stable. That supplies outcomes analysis for SR 11-7 and measurement for the AI RMF in one run. Certificates lapse after 90 days, and a run that clears no depth drops the agent to depth 1 the same day.
Questions people ask
Do examiners expect banks to adopt the NIST AI RMF?
It is voluntary, and examiners supervise against SR 11-7 and other guidance. Many banks adopt it because it gives a structure for AI risks that model risk policies do not fully cover.
Who should own agent risk: model risk or operational risk?
Both have a part. Model risk validates the agent's outputs; operational risk covers process, people and third parties. Agree the split in policy so nothing falls between them.
Does the Generative AI Profile apply to agents?
Yes, where agents are built on generative models, which most are. It adds risks such as fabricated content and information security issues specific to generative systems.