SR 11-7 applies to AI agents in US banks through the same three elements it sets for every model: sound development and use, independent validation, and governance with controls. Agents add a twist to its two sources of model risk. They can be wrong, and they can be misused, including by themselves, when they attempt actions outside their intended scope.
What does SR 11-7 require, in plain words?
SR 11-7 is the interagency supervisory guidance on model risk management. It defines model risk as the potential for adverse consequences from decisions based on incorrect or misused model outputs, and identifies two sources: fundamental errors in the model, and incorrect or inappropriate use. It asks banks to manage model risk through three elements:
- Model development, implementation and use: a clear statement of purpose, sound theory and method, appropriate data, testing, documentation, and use by people who understand the model's limitations.
- Model validation: independent evaluation of conceptual soundness, ongoing monitoring, and outcomes analysis, proportionate to risk.
- Governance, policies and controls: board and senior management oversight, written policies, defined roles, a model inventory, documentation, internal audit review, and attention to vendor models.
Effective challenge runs throughout. For scope, see is an AI agent a model under SR 11-7, and for background, our glossary entry on model risk management.
Who does it apply to?
Banking organisations supervised by the Federal Reserve and the OCC, with the FDIC applying the same approach to the banks it supervises. Many fintechs and non-bank lenders adopt it because bank partners require it. For the short answer, see does SR 11-7 apply to AI agents.
How do SR 11-7's two sources of risk play out for agents?
Fundamental errors. An agent's errors include a misreading of policy in its brief, reliance on a stale source, a confabulated fact, or a wrong tool call. Some are systematic: every case of a certain kind goes wrong the same way. SR 11-7's emphasis on testing and conceptual soundness addresses these, provided testing reaches the agent's actions and not only its text.
Incorrect or inappropriate use. For traditional models, misuse means people using outputs for purposes the model was not built for. Agents add a new form: the agent may attempt to act beyond its intended scope, because a customer asked, because an instruction was ambiguous, or because injected text told it to. A collections agent that offers a payment arrangement it was not designed to offer is misusing itself. SR 11-7's call for use within the model's limitations becomes, for agents, a requirement that scope is enforced outside the model.
There is also the older form of misuse. Staff who review agent drafts may begin to accept them without reading, so the agent's output is used as if it were a validated decision. Tracking override rates shows whether review is real.
What does each element require for agents?
Development, implementation and use. Document the agent's purpose, brief, sources, tools and limits. Test it on the bank's own cases before it acts. Make sure users, including reviewers of held actions, understand where the agent is weak.
Validation. Evaluate conceptual soundness of the brief and design, monitor performance in use, and analyse outcomes against what actually happened to customers. See SR 11-7 model validation for agents for detail.
Governance. Put agents in the inventory, with restrictions on use recorded. Set policy on how agents gain and lose authority. Report to senior management and the board. Have internal audit test that the framework works for agents.
Take an illustrative case. A US regional bank's agent drafts responses to mortgage escrow questions and can execute escrow refunds below a set amount. Development documented its purpose and limits; validation tested it on past escrow cases; governance placed it in the inventory with restrictions enforced by the control layer. Six months in, outcomes analysis finds refund amounts occasionally miscalculated after a mid-year tax change. Under the bank's policy, refund authority drops to drafting until the agent passes retesting with the updated source.
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Purpose and design | Documented purpose, brief, sources, tools and limits per agent | Design documentation |
| Testing before use | Testing on the bank's own cases, covering actions as well as answers | Test reports by capability |
| Use within limitations | Scope and limits enforced outside the model; users told of weaknesses | Verdict log; user guidance |
| Conceptual soundness | Independent review of brief and design against policy | Validation report |
| Ongoing monitoring | Override rates, escalations and fixed-case replay tracked | Monitoring reports |
| Outcomes analysis | Agent actions compared with correct outcomes after the fact | Outcomes analysis reports |
| Inventory | Agents recorded with restrictions and validation status | Inventory entries |
| Policy and roles | Policy on agent authority; named owners and validators | Policy; role assignments |
| Board and senior management | Aggregate agent risk reported | Board and management packs |
| Internal audit | Audit of the framework's application to agents | Audit reports |
For a ready entry format, see our model risk inventory entry template for an AI agent.
What will examiners ask?
- Which agents are in scope, and how did you decide?
- How do you prevent agents from acting outside their intended use?
- Show us validation and outcomes analysis for an agent that acts.
- How do you know staff are not simply accepting agent drafts?
- What does the board see about agent risk?
What does SR 11-7 not cover?
It does not address conduct towards consumers, fair lending, privacy or cybersecurity directly, though agents raise all of them and other rules apply. It predates generative AI, so it says nothing specific about language models; banks apply its principles by analogy. For the binding rules beyond model risk, see our guide to AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Does SR 11-7 require agents to be explainable?
It requires that models be understood well enough to manage their risk, and that users understand limitations. For agents, recording which facts and sources each action relied on gives a practical form of understanding that a language model's internals cannot.
Is an agent's misuse of itself really model risk?
Yes, in substance. SR 11-7 treats inappropriate use as a source of model risk. An agent that acts beyond its intended scope produces exactly the adverse consequences the guidance is concerned with.
How should a bank tier agents for model risk?
By the impact of their outputs and what they can do with them. Agents that move money or decide about customers belong in higher tiers than those that only read and summarise.