Examination readiness is the ability to produce, on demand, the evidence a regulator asks for: the inventory of AI models in use, the policy in force on a given date, and the record of what each user and agent was permitted to do. Smartflow generates those packages from runtime enforcement records.
From Months of Preparation to 24 Hours
A single regulatory examination preparation cycle consumes months of consulting time. Compliance teams assemble evidence from spreadsheets, email chains and disconnected log systems. When the examiner arrives, the package is already outdated.
Smartflow's Regulatory Examination Suite generates complete, current evidence packages from the audit data that Smartflow already collects during normal operation. One API call. 24 hours. Examination-ready.
What changed in April 2026
On 17 April 2026 the Federal Reserve issued SR 26-2, superseding SR 11-7; the OCC issued Bulletin 2026-13 the same day. Any examination-readiness claim still built on SR 11-7 by number is built on rescinded guidance.
The more consequential change is what SR 26-2 left out. It places generative and agentic AI outside its scope, while stating that a banking organization's own risk management and governance practices should determine the controls for systems it does not cover. The obligation did not disappear. It moved onto the institution, which now has to evidence how its agents behaved without a model risk framework to point at.
That is the gap this page is about. The frameworks below are the ones that still bind.
Supported Frameworks
FINRA Rule 3110 Supervision Package
Supervisory controls documentation, AI-assisted communication review evidence, information barrier enforcement reports with 90-day violation retention, and attestation reports. Rule 3110 is enforceable, technology-neutral, and the rule under which supervisory failures are most often charged — and FINRA has published directly on AI agents and prompt injection. It is the strongest examination hook a broker-dealer has.
Model Inventory
Automated AI model inventory with risk classification, validation status, outcomes monitoring, and lifecycle tracking. Every model Smartflow routes traffic to is automatically catalogued. Traditional and non-generative models remain within SR 26-2's scope; generative and agentic systems sit outside it, which is precisely why an inventory produced by the traffic layer rather than by a survey matters.
FFIEC IT Controls Assessment
IT risk assessment, access control documentation, audit trail integrity verification, and incident response evidence.
EU AI Act High-Risk System Documentation
Technical documentation, record-keeping evidence, human oversight mechanisms, and transparency documentation as required by Articles 12-15.
How It Works
- Step 1: Deploy Smartflow as your AI governance control plane.
- Step 2: Smartflow collects governance telemetry during normal operation. No additional work required.
- Step 3: When examination approaches, generate the evidence package via single API call or Maestro dashboard.
- Step 4: Review with your compliance team. Submit to the examiner.
Related reading
AI incident response · Tamper-evident audit log · Model drift · MITRE ATLAS · AI supervision evidence checklist · Board reporting
Put this in the path of your own agents.
Policy enforced inline between your agents and every model and tool they reach, with a record bound to the human who owns it.
Request a Demo Read the docs