On April 17, 2026, the Federal Reserve, OCC, and FDIC issued SR 26-2 — updated joint guidance on model risk management. The headline change is that deterministic rule-based systems are explicitly carved out of the model definition, while generative AI is left in a governance gap. The practical question it creates for every CIO at a regulated institution is simple: can you reproduce the number you reported?
What the guidance actually says
SR 26-2 defines a model as a tool that applies "statistical, economic, financial, mathematical, or other quantitative methods" to produce an output. It explicitly excludes "deterministic rule-based processes and software where there are no statistical, economic, or financial theories underpinning their design or use."
That exclusion is significant. It means a deterministic IT financial system — one that applies fixed rules to source data and produces the same output every time — sits outside the model risk management framework. It does not require the validation infrastructure, the independent review cycle, or the ongoing monitoring that a statistical model does.
Generative AI, by contrast, sits in a defined gap. SR 26-2 notes that "generative AI and agentic AI models are novel and rapidly evolving" and are "not within the scope of this guidance," while adding that governance expectations still apply. That is not a free pass. It is an acknowledgment that the governance framework for generative AI has not been written yet.
The question your board will ask
The question is not "are you using AI?" Most boards have moved past that. The question is "when your AI system produces a number that goes into a regulatory report, can you reproduce that number on demand?"
For a probabilistic system, the honest answer is no. The same input fed to the same model at two different times will produce outputs that are "mostly" the same — OpenAI's own documentation uses that word — but not identical. "Mostly" is not an acceptable answer when an examiner asks you to reproduce a calculation.
For a deterministic system, the answer is yes, by definition. Same rules, same data, same output. Every time.
The architecture question
SR 26-2 does not require you to stop using AI. It requires you to know which part of your analytical stack is producing which outputs, and to be able to defend the outputs that carry regulatory weight. The architecture question it creates is: where in your pipeline does the number that goes into the report get produced, and is that component deterministic?
If the answer is that an LLM produces the number, you have a governance problem. If the answer is that a deterministic rule engine produces the number and an LLM writes the narrative around it, you have an architecture that SR 26-2 was designed to accommodate.
That is the distinction TekLedger is built on.