Six Months After Regulators Set Aside AI Agents, the Rulebook Still Isn't Here

If you've been waiting for federal regulators to say how banks and credit unions should govern AI agents, you're still waiting. The most recent update is that, as of early October, the formal request for information the agencies promised in April has not been published.

Here's how we got here. On April 17, the Federal Reserve, the OCC, and the FDIC issued a rewrite of their model risk management guidance, the first major update since 2011. It replaced the long-standing SR 11-7, and the OCC published it as Bulletin 2026-13. In a single footnote, the guidance places generative and agentic AI outside its scope, describing them as novel and rapidly evolving, and tells banks to govern those systems under their existing risk management practices. The agencies said a request for information on AI would follow in the near future.

An analysis published October 6 notes that this request had still not appeared. An August review of the compliance landscape reached the same conclusion about that point in time. Meanwhile, the European Union and Singapore are moving to cover AI agents directly.

What this means for credit unions

The NCUA wasn't one of the agencies behind the April guidance, and it has no standalone AI rule of its own. So the gap is wider for credit unions, not narrower. You can't point to a regulation that tells you what's required, and an examiner can't point to one that tells them what to cite. That cuts both ways: you have flexibility, and you have responsibility.

A few reports from the banking side suggest what examiners are curious about. Coverage of recent supervisory conversations mentions questions about whether an institution can stop an AI system when something goes wrong, how vendors handle subcontractors, and where data is allowed to flow. Separately, research from Capgemini cited in industry coverage found that close to half of banks and insurers are creating new roles specifically to supervise AI agents. Treat those as signals about direction, not as requirements.

Don't wait for a rule that may take a year

Even once the request for information is published, comment periods and rulemaking take time. The practical response is to write your own standard now, in four parts:

1. Inventory. Which AI tools are in use, including features vendors have added to products you already own.
2. An owner. One named person who can pause or switch off each tool, and who knows how.
3. Vendor documentation. What each vendor will tell you about how the tool was built, tested, and monitored, and who their subcontractors are.
4. Data boundaries. What member data each tool can see, and what it's allowed to do with it.

A short document covering those four points won't satisfy a regulation that doesn't exist yet. It will, however, make you the credit union that can answer questions calmly when they come, which is a better position than scrambling after a rule lands.

Sources

• Model Risk Management: Revised Guidance, OCC Bulletin 2026-13 (OCC)
• SR 26-2 control framework for generative and agentic AI at banks (Lumenova)
• The 2026 Compliance Checklist for AI Agents in Banking (Diagrid)
• Banks Lost Their Model-Risk Letter for Agentic AI (MightyBot)
• Fed Vice Chair Warns AI Agent Sprawl Needs Updated Bank Supervision (AI2 Work)