The banking sector's federal regulators just told examiners, in writing, that agentic AI does not fall inside the current supervisory rulebook. On April 17, 2026, the Federal Reserve, the Office of the Comptroller of the Currency, and the Federal Deposit Insurance Corporation issued SR 26-2, revised model risk management guidance that replaced the sixteen year old SR 11-7 standard, and stated plainly that generative and agentic AI models are novel and rapidly evolving and therefore not within its scope. Five months later, the gap that declaration created did not stay empty. The Conference of State Bank Supervisors published its own AI Supervisory Framework on September 16, 2026, handing state examiners eight specific questions and a three tier risk classification for exactly the systems the federal guidance declined to cover.

Washington Excluded Agentic AI. State Examiners Did Not Wait for an Invitation.

SR 26-2 replaced SR 11-7, the model risk framework that had governed how banks validate the models behind lending, pricing, and risk decisions since 2011. A revision of that scope is the kind of document a board's risk committee reads line by line. The line that matters most is the one carving generative and agentic AI out of the document entirely, on the stated grounds that the technology is moving too fast for a settled rule.

That is a defensible drafting choice for a national standard. It is also, functionally, a declaration that the newest and least tested category of AI risk in a bank's operations has no federal model risk rulebook written for it yet. A board that reads the exclusion as reassurance, rather than as an open question, has misread the document. All three agencies have signaled plans to issue a request for information on AI-specific model risk management, a first step toward a rule, with no publication date set.

Four in Five Banks Answer to the Examiner Who Filled the Gap

CSBS is not a peripheral voice here. State agencies supervise close to 80 percent of the country's FDIC-insured banks, a share that dwarfs the population directly covered by the OCC's national charter. When CSBS President and CEO Brandon Milhorn describes the new framework as a principles-based approach intended to help financial institutions explore and implement AI with additional confidence, he is describing a document that will shape examinations for most of the industry, not a minority carve-out.

The framework creates no new substantive requirement and leaves examiners discretion in how they apply it. That caveat is accurate and practically limited. A tool that gives every state examiner the same eight questions and the same three risk tiers stops behaving like a suggestion the moment the first examination cycle opens under it.

The Accountability Contract State Examiners Wrote, and Washington Did Not

Touch Stone's Accountability Contract Model holds that accountability is not a value a document can assert. It is a conversation that has to state four things before results can fairly be demanded of anyone, what needs to be done, what authority is granted to do it, what success looks like, and what the timeline is. SR 26-2 supplied none of the four for agentic AI. It named the category, then wrote it out of the document, which is the regulatory equivalent of assigning no owner to a known risk.

CSBS supplied all four in a single release. What needs to be done is defined by eight specific questions, not a vague call for responsible AI. What success looks like is defined by the three tier classification, which turns a bank's AI footprint into a rated exposure rather than an unexamined one. The authority is the examiner relationship itself, which needs no new legislation to activate. The timeline is now, since the framework was approved in August and released September 16.

A board audit or risk committee that treats CSBS's framework as optional guidance from a body with no compulsory power has confused the source of the contract with its force. It will be enforced at the next examination, by the same examiner who has always had authority to ask about risk management. CSBS simply wrote down which questions those will be.

What a State-Chartered Bank's Board Does Before the Next Exam

Three responses follow directly from the gap between the two documents, and none require waiting for a federal rule that has not been drafted.

A risk or audit committee should request a management self-assessment against the CSBS worksheet and its three risk tiers before the next examination cycle opens, rather than encountering the tiering system for the first time from an examiner. The self-assessment is the same document the examiner will eventually build; producing it first changes who is explaining the AI footprint to whom.

Boards should stop treating exclusion from SR 26-2 as a statement about exposure and start reading it as a statement about jurisdiction. It says which federal document does not apply. It says nothing about whether a state examiner, a plaintiff's attorney, or a D&O underwriter will treat the absence of a federal rule as evidence of a governed risk or an unmanaged one.

Multi-charter institutions should confirm, subsidiary by subsidiary, which parts of the organization carry state charters subject to CSBS-aligned examination, since the governance posture required is no longer uniform across the group.

The bank that waits for a federal rule before building its own agentic AI oversight file is answering the wrong regulator's question. The one that can produce the CSBS self-assessment before an examiner asks for it will not experience that request as new compliance overhead. It will read, to the examiner and to the board, as the file that was already being kept.