Your copilot fell out of model risk guidance. Keep reviewing it anyway.
US bank regulators left generative and agentic AI out of the new model risk guidance. Why that is a gap to fill yourself, not a pass to skip AI governance.
This spring, US bank regulators retired SR 11-7, the model risk guidance every bank risk team could recite in its sleep. The replacement (OCC Bulletin 2026-13, SR 26-2 at the Fed) says generative and agentic models are "novel and rapidly evolving" and therefore "not within the scope of this guidance."
I have already heard this read aloud in a meeting as good news (one fewer checklist for the copilot rollout). It is not good news. It is a blank page.
Nothing about your copilot got safer in April. It still answers customers, drafts credit memos and summarizes things a regulator may one day ask about. The agencies themselves say a request for information on AI model risk is coming. When the rules arrive, the banks with an inventory, a test record and a named owner will be explaining a process. Everyone else will be building one under a deadline.
So keep doing the work the old guidance would have asked for. List every generative tool in use, write down who owns each one, and test the outputs that touch customers or decisions. Our governance policy template is a fine place to start, and it was never written for a regulator anyway. It was written for the Tuesday something goes wrong.