Definition
AI model governance is the set of policies, controls and records an institution uses to approve, validate, monitor and audit the models and AI systems it relies on. In banking it builds on model risk management and third-party risk management.
A bank that uses machine-learning scores, AI agents or generative AI in compliance needs to show who approved each system, how it was tested, what data it uses, how it's monitored and who is accountable for its outputs. AI model governance is the framework that answers those questions, from inventory and validation to change control and audit.
Current US guidance
On April 17, 2026, the Federal Reserve, OCC and FDIC issued revised interagency guidance on model risk management as SR 26-2 and OCC Bulletin 2026-13. It supersedes SR 11-7 and the 2021 interagency statement on model risk management for BSA/AML systems. The guidance is principles-based, is expected to be most relevant to banking organizations with over $30 billion in total assets, and excludes deterministic rule-based processes from the definition of a model. The agencies treat generative and agentic AI as outside its scope for now, pending a future request for information, so banks govern those systems under their own frameworks in the meantime.
How it works in practice
Inventory and ownership. Every model and AI feature in use is recorded with an accountable owner.
Validation and testing. Systems are tested before use and after material changes, including edge cases and adversarial inputs.
Change control. Model versions are pinned and changed through an approval process.
Explainability and human oversight. Outputs show their inputs and reasoning, and a person makes consequential decisions.
Audit trail. Each AI action is logged with enough context to reconstruct it for an examiner.
Outside the US, the EU AI Act sets obligations by risk category, and the NIST AI Risk Management Framework and its generative AI profile give a common structure for governing, mapping, measuring and managing AI risk.
Why banks and regulators care
AI in AML touches decisions examiners scrutinize: which alerts are closed, which cases escalate and what SAR narratives say. When the AI comes from a vendor, third-party risk guidance applies too. Banks need evidence that the vendor's AI is controlled, explainable and auditable, not just accurate.
How Corsa supports it
Corsa's AI is designed to fit a bank's governance program. Each AI feature is opt-in and toggled independently. Models can be privately hosted, and versions are pinned and updated through change management. Models and agents are tested against curated benchmarks, adversarial inputs and edge cases before production. Agents show their rationale and the data they examined, the analyst makes the final call, and meaningful agent actions and guardrail activations are logged and exportable. Customer data is never used for training. See Private AI for compliance.
How Corsa helps:
Security & data privacy →
Frequently asked questions
What is the current US model risk guidance for banks?
SR 26-2 and OCC Bulletin 2026-13, issued April 17, 2026 by the Federal Reserve, OCC and FDIC. They replace SR 11-7 and the 2021 BSA/AML model risk statement, and they're principles-based rather than enforceable standards.
Does SR 26-2 cover generative and agentic AI?
No. The agencies treat generative and agentic AI as outside the scope of the revised guidance for now, pending a future request for information. Banks govern those systems under their own policies and third-party risk programs in the meantime.
Are AML transaction monitoring rules models under SR 26-2?
The revised guidance excludes deterministic rule-based processes from the definition of a model. Machine-learning scores can still fall within it, and banks should still document how rules are tested, approved and changed.
