Your Models Work in a Notebook. Production Is a Different Problem.

No. We sit on the build side: we get models into production, instrument them, and produce the evidence a validator or an examiner will ask for. On independence the 2026 guidance is less rigid than most people expect, saying the quality of the validation process depends on the rigor and effectiveness of the review rather than on the organizational structure of the risk management function. We would still not validate our own build and call it independent. If what you need is an independent validation opinion, you want a separate firm, and we will tell you that on the first call.

US interagency model risk guidance was revised on 17 April 2026. Federal Reserve SR 26-2 supersedes SR 11-7, which had been the reference point since 2011, with companion issuances from the OCC and FDIC. Anything published before April cites the 2011 letter, and plenty of internal model risk policies still do too. If yours does, that is a reasonable first thing to look at. What we will not do is tell you what the revision means for your specific models before reading your policy set against the current text, and you should be wary of anyone who will.

Not directly. Federal model risk guidance is addressed to supervised banking organizations. It reaches a non-bank in practice through the partner: a sponsor bank is accountable for the models used in its programs, and it discharges that through third-party risk management. So the expectations arrive in your diligence questionnaire rather than from a regulator, and arguing about the technicality does not help you answer the questionnaire.

Under the April 2026 interagency guidance, no. Footnote 3 places generative and agentic AI outside its scope, on the stated grounds that both are novel and rapidly evolving. That is narrower than most people assume, and it is not the relief it sounds like: out of scope for this guidance is not the same as unreviewed, and a sponsor bank will still ask what controls you run before it lets a language model near a customer decision. So the work does not go away, it just stops being a model validation exercise. We validate the system rather than the weights: retrieval, guardrails, the evaluation harness, refusal behavior, and which human is accountable when it is wrong.

Gradient boosting, yes. Simple rules, probably not. The April 2026 guidance defines a model as a complex quantitative method applying statistical, economic, or financial theories, and it explicitly excludes deterministic rule-based processes and software where no such theory underpins the design or use. So a hand-tuned rules engine can sit outside the definition even while it makes consequential decisions. That catches people out, and it cuts both ways: outside the definition means nobody is required to validate it, which is how a rules engine quietly becomes unreviewed policy. We would put it in the inventory anyway.

For a single model with a clear owner, 4-8 weeks from kickoff to a production deployment with monitoring and a validation package. A portfolio of undocumented models is a longer job, and the first pass should triage by risk rather than attempt everything. We would rather get your three highest-risk models properly governed than produce thin paperwork for thirty.

Reasonable of them, if governance has previously meant a spreadsheet they fill in for someone else. The version worth having gives them a deployment path they do not currently have, and takes the audit correspondence off their desk. If the process does not make shipping easier, it will be circumvented, and a circumvented control is worse than an acknowledged gap.