SR 11-7, the interagency guidance on model risk management, rests on effective challenge: critical review by people with the competence, influence and incentive to question a model. In a US bank running AI agents, that makes training a control. Model owners, users and validators must understand what each agent does, how it fails and what evidence supports its use.
What does SR 11-7 ask of the people around a model?
SR 11-7 is supervisory guidance issued by the Federal Reserve and adopted by the OCC. It defines a model broadly, as a quantitative method or approach that processes input data into estimates, and it describes model risk as the potential for loss from models that are wrong or used wrongly. In substance it expects banks to manage that risk through:
- Sound development, implementation and use. Models should be fit for their intended purpose, built on suitable data, tested, documented, and used within known limits.
- Validation. An independent, ongoing process that checks conceptual soundness, monitors performance and analyses outcomes.
- Governance, policies and controls. Board and senior management oversight, a model inventory, clear roles, internal audit, and the same discipline for models from vendors.
Running through all three is effective challenge. The guidance is explicit that challenge depends on people who have the technical knowledge to question a model, the standing to have their concerns acted on, and the incentive to raise them. Untrained reviewers cannot challenge. That is why training is not an add-on to SR 11-7; it is part of meeting it.
Whether an agent counts as a model is covered in is an AI agent a model under SR 11-7. Where it produces estimates, scores or decisions from data, or depends on a model that does, banks generally treat it as within scope.
Who does it apply to?
Banking organisations supervised by the Federal Reserve and the OCC, with the FDIC applying similar expectations to the banks it supervises. Within a bank, the roles are model owners, developers, users, validators, internal audit, the model risk function and senior management. The overview of whether SR 11-7 applies to AI agents sets out how banks are drawing the line.
What must an agent's model owner and challengers understand?
What the model is. An agent combines a foundation model from a vendor, a brief, sources, connections and bounds. Owners must agree with the model risk function which parts are inventoried, and treat changes to any of them as model changes.
Intended use and limits. SR 11-7 stresses using models within their limits. For agents, limits are explicit. Each action needs a depth: read at 1, draft at 2, execute routine work at 3, move money or take hard-to-undo actions at 4. Depth is earned, not configured: the agent's role sets a ceiling, evidence sets the depth, and the lower wins. Owners must know the agent's depth, the depth each action needs, and why.
Outcomes analysis. Validators need evidence that the agent performs on the bank's own cases. Attest replays the agent against real cases and scores every answer against a floor across seven gates, including grounded, refuses, scope, adversarial and stable. Owners must present these results and accept challenge on them.
Ongoing monitoring. Agent certificates lapse after 90 days, and a lapse or a run that clears no depth drops the agent to depth 1 the same day. Owners must plan recertification and treat drift as a monitoring signal.
Vendor models. The foundation model is a vendor model. SR 11-7 expects banks to understand vendor models as far as possible and to validate their use. Owners must know how the vendor communicates changes and how the bank tests them.
Fair lending. Where an agent contributes to credit decisions, ECOA and Regulation B require specific reasons when credit is denied, including when a model is used. Owners and users must ensure the agent's reasons are specific and accurate enough to support an adverse action notice.
Users as challengers. Staff who release held actions are model users. They should be trained to question the agent's output, and their overrides should feed back to the owner as outcome data.
How do banks meet SR 11-7 and show it?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Inventory | Agents and components inventoried | Model inventory entries |
| Intended use and limits | The agent's depth and the depth each action needs, documented with rationale | Depth register; owner sign-off |
| Effective challenge | Validators and users trained on the agent before review rights | Training and assessment records |
| Validation and outcomes analysis | Certification on the bank's own cases reviewed by validators | Validation reports; certification history |
| Ongoing monitoring | Drift, overrides and recertification tracked | Monitoring reports |
| Vendor models | Vendor change assessments | Change impact records |
| Adverse action reasons | Agent reasons reviewed for specificity | Sampled notices; review results |
| Governance | Senior management reporting on agent model risk | Committee packs; minutes |
The link with broader AI risk management is drawn in NIST AI RMF and SR 11-7: model risk for AI agents in US banks.
What will examiners or auditors ask?
- Which agents are in the inventory, and how are they risk-rated?
- Who owns this agent, and what training did they receive?
- Who challenged it, and were they competent to?
- What evidence supports the agent's depth?
- How do you handle changes to the vendor's model?
- How do agent reasons support adverse action notices?
What does SR 11-7 not cover?
It is guidance, not a regulation, though examiners apply it. It does not cover consumer protection rules directly, which the CFPB enforces for many firms. It does not cover privacy, which GLBA and state laws such as the CCPA as amended by the CPRA govern. It does not prescribe training. And there is no single federal AI law. For a broader US training view, see what AI agent training organisations in the US need. The guide to AI literacy and certification covers the wider model.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Does effective challenge require technical experts?
It requires people competent to question the model in context. For agents, practical understanding of capabilities, sources and failure modes matters as much as technical depth.
Are staff who release agent actions model users?
Yes, in substance. They rely on the agent's output and should be trained to question it.
How often should agents be revalidated?
In proportion to risk, and whenever capabilities, sources or the vendor model change. Certification lapsing after 90 days gives a natural cycle.