On October 14, 2026, APERION filed a comment letter with the OCC, the Federal Reserve, the FDIC and the NCUA on their proposed third-party risk management guidance (91 FR 58536, September 15, 2026).
The proposal would replace the 2023 interagency guidance that banks use to oversee their vendors, AI vendors included. It does not mention artificial intelligence. In April, revised model risk management guidance, SR 26-2, placed generative and agentic AI outside its own scope. If the proposal is finalized as written, AI sits outside one framework by carve-out and inside the other only by inference.
The letter makes five recommendations. The first asks for one sentence: that AI services are covered on the same risk-based terms as any other third-party relationship. It adds no new obligation.
Comments close November 16, 2026.
Put this in the path of your own agents.
Policy enforced inline between your agents and every model and tool they reach, with a record bound to the human who owns it.
Request a Demo Read the docs