US AI governance for financial services, the 2026 regulatory landscape
US financial services AI governance is shaped by sector-specific regulation from multiple agencies, each with enforcement authority. There is no single federal AI law, but the combination of existing statutes, new supervisory guidance, and active enforcement creates a substantive and enforceable framework.
Federal Reserve SR 26-2 (17 April 2026)
The most significant recent development. SR 26-2, Revised Guidance on Model Risk Management, supersedes SR 11-7 and SR 21-8 and is expected to be most relevant to banking organisations with over $30 billion in total assets. It requires: materiality-tiered model risk management (not all models get the same governance); continuous validation replacing annual revalidation; board-level accountability for model risk governance; and application of its principles to traditional statistical and quantitative models and to non-generative, non-agentic AI models. Generative AI and agentic AI models are expressly outside its scope. Footnote 3 places generative AI and agentic AI models entirely outside the scope of the guidance, on the basis that they are novel and rapidly evolving, while stating that a banking organisation's own risk management and governance practices should guide the governance and controls applied to any tools, processes or systems not covered. Federal Reserve, OCC, and FDIC issued it jointly, reflecting supervisory consensus.
CFPB
The Consumer Financial Protection Bureau has been active on AI credit and lending decisions. ECOA and FCRA adverse action notice requirements apply fully to AI-driven decisions, lenders cannot hide behind algorithmic complexity to avoid providing specific denial reasons. The CFPB has pursued enforcement actions involving AI in credit, collections, and servicing.
SEC
The SEC has focused on AI in broker-dealer and investment adviser contexts: AI-driven investment recommendations, predictive data analytics, and the use of AI in securities marketing (including "AI washing", misleading claims about AI capabilities). The SEC's 2023 proposed rules on predictive data analytics (conflicts of interest for broker-dealers and investment advisers) were formally withdrawn by the Commission in June 2025 and are no longer pending.
OCC
The OCC's previous model risk management guidance, OCC Bulletin 2011-12, was rescinded on 17 April 2026 by OCC Bulletin 2026-13, which adopts the same interagency revised guidance the Federal Reserve issued as SR 26-2. OCC examiners increasingly assess AI governance during examinations.
State regulation
State regulators and laws add another layer: Colorado's AI Act was repealed and replaced by SB 189 (a narrower disclosure-based law effective 1 January 2027); NYC AEDT law (effective since July 2023) regulates automated employment decision tools; Illinois BIPA and Illinois AI Video Interview Act; multiple states have introduced AI insurance regulation. State attorneys general have enforcement authority under consumer protection statutes that apply to AI.
What financial services firms should do
For banks >$30B: implement SR 26-2 immediately, this is current supervisory guidance. For all financial services: maintain an AI model inventory with materiality classification; implement validation appropriate to risk tier; establish board reporting on AI risk; include AI-specific provisions in vendor contracts; prepare for examination questions on AI governance. For consumer-facing AI: ensure adverse action notice compliance; implement fair lending testing for AI credit models; monitor CFPB enforcement developments.
Primary sources: Federal Reserve SR 26-2 · CFPB · OCC
