When the Federal Reserve, OCC, and FDIC replaced SR 11-7 this April, most commentary focused on what the new guidance says. Six months in, the more useful question is what examiners ask. Early exam-cycle conversations across the industry suggest a consistent pattern.
The four questions that keep appearing
“How many AI systems do you operate?” Not models on the validated inventory — systems. Copilots, vendor agents, AI features embedded in SaaS. Institutions that answer with a number backed by discovery, rather than a survey, set the tone for the whole exam.
“Who decided this system’s risk tier, and on what basis?” The new guidance is explicitly materiality-based. Examiners want to see tiering that maps to what a system can actually do — its data access, its autonomy, its customer impact — not a spreadsheet column set to “low” by default.
“Show me one decision, end to end.” This is the question that separates programs from paperwork. Pick a customer-affecting output from an AI-assisted workflow and reconstruct it: what governed it, what grounded it, which version produced it, who approved it. Institutions that can do this in minutes have a different exam than institutions that need three weeks and a war room.
“What happens when it misbehaves?” Escalation paths, suspension authority, and — increasingly — whether anyone can actually shut an agent down. The honest industry answer today is uncomfortable, which is why the question keeps being asked.
The practical read
None of these questions requires heroics. They require an estate you can see, tiers you can defend, decisions you can reconstruct, and a kill switch you have tested. If your AI program can produce those four artifacts on demand, SR 26-2 is a documentation exercise. If it can’t, no binder will save the exam.