SR 26-2 is now the governing framework for model risk management, replacing SR 11-7. The shift from prescriptive checklists to a risk-based approach has real implications for how AML teams govern, validate, and document AI. This session covers what the new guidance actually requires, how to determine when an AI agent qualifies as a model.

Key takeaways

• Definitional ambiguity is not the same as regulatory comfort: If a system is influencing alert disposition, governance expectations follow the risk regardless of how the system is labeled.

• Agentic AI can degrade without breaking: Prompts shift, analyst trust increases and escalation rates can quietly drop without a visible failure.

• Stability testing requires a higher bar than most teams expect: Ask vendors how they test for drift and what happens when the underlying model changes.

• Exam readiness is a workflow governance exercise: If you can't explain how the system influenced a specific alert decision, a policy and a vendor review won't be enough.

• The compliance role is shifting toward oversight: L1 alert review is increasingly automated, and professionals who can evaluate AI systems will be the ones who remain indispensable.