Fed SR 26-2 keeps covered vendor models inside validation

Put the purchase inside the model inventory

A procurement record is not a model record. For a covered vendor model used in planning, liquidity, reporting, valuation, or control work, finance should be able to identify the exact version, business purpose, decision owner, inputs, outputs, dependencies, materiality, and approved limits of use. Link the contract and vendor documentation to that inventory entry, but do not let them replace it. The useful test is whether an independent reviewer could reconstruct what finance relied on, why the model was suitable for that use, and what would cause its use to be restricted or stopped.

Treat limited transparency as a risk condition

A vendor may protect intellectual property or decline to expose every implementation detail. SR 26-2 does not turn that commercial constraint into evidence of soundness. Finance can record what the vendor supplied about theory, design, development data, performance, limitations, and change management; identify what remains unavailable; and decide whether testing, contractual rights, use restrictions, or compensating controls make the residual uncertainty acceptable. If the organization cannot obtain enough information to understand the model for its intended use, that gap belongs in the approval decision rather than in a footnote after deployment.

Validate the configured use, not the brochure

Vendor benchmarks describe a product under selected conditions. They do not establish performance on the institution's data, configuration, thresholds, overrides, integrations, or decision process. Validation should examine the conceptual basis and the observed results for the actual use, then continue through monitoring and outcomes analysis. Material customizations need documentation, and vendor changes need a route back through change control. The CFO should see who owns performance review, which indicators reveal deterioration, how exceptions are escalated, and whether several vendor models create a concentrated dependency across the finance portfolio.

Keep the scope boundary explicit

This source offers a strong discipline for covered vendor models, but it does not place generative or agentic AI inside SR 26-2. A finance copilot or action-taking agent still needs an evidence record for data access, retrieval, instructions, tool permissions, approvals, evaluation, incidents, and retirement under the controls and obligations that actually apply. Teams may borrow useful questions from model-risk practice, provided the record labels them as internal design choices rather than supervisory compliance. That distinction lets finance demand serious vendor evidence without making an assurance claim the source expressly does not support.

Turn this source into a reviewable decision

For AI for CFOs, use this briefing as a dated decision record rather than a substitute for the source. Preserve Board of Governors of the Federal Reserve System, the exact URL, the July 26, 2026 review date, the supported facts above, the editorial interpretation, the limitations, and any buyer-specific evidence. Link that record to the decisions most directly affected: Planning and scenario analysis; Cash visibility and liquidity decisions; Management reporting and external disclosure support; Internal control and audit evidence. State whether the source changes the scope, evidence requirement, control, sequence, or only the language used to describe the decision.

Before action, name the accountable owner, affected population and workflow, exact offering or configuration, source data and rights, human decision point, exception and appeal path, complete cost, expected benefit, failure and stop conditions, retained evidence, and next review date. Keep official facts, provider statements, buyer observations, representative tests, measured outcomes, editorial inferences, and unknowns visibly separate. Reopen the record when the source, offer, model, integration, data, policy, population, responsible person, or measured result changes.

Limitations and unknowns

SR 26-2 applies to specified banking organizations and to models within its stated definition. It is not a general procurement standard, expressly excludes generative and agentic AI models, and cannot establish that a particular vendor product is accurate, compliant, controlled, or suitable for a finance decision.