What it means when regulators say generative AI "out of scope"

When the federal banking agencies released their revised model risk management guidance, most focused on what was included. The more important story is what wasn't..Tucked inside footnote 3 is a quiet but consequential disclosure: generative AI and agentic AI are explicitly out of scope. For institutions already deploying these technologies, or relying on vendors that are, that single footnote carries significant weight.Out of scope does not mean low risk. It means regulators have not yet developed a framework capable of addressing how these tools behave, how their outputs should be validated, or how accountability should be assigned when something goes wrong. The technology has outpaced the rulebook, and institutions are being left to write their own.Federal Reserve Vice Chair for Supervision Michelle Bowman made that reality explicit when she addressed the FSOC AI roundtable earlier this month. Bowman acknowledged that the Fed, along with the OCC and FDIC, amended the model risk management guidance specifically because prior guidance had been stretched beyond its original scope. In other words, regulators are not simply declining to address generative AI. They are actively walking back the assumption that existing frameworks were ever adequate for it. That is a meaningful admission, and institutions should read it as one.That is a meaningful distinction from how traditional model risk management was designed to work. SR 11-7 and its successor guidance were built around predictable, auditable models with defined inputs and outputs. A credit scoring model follows a documented logic path. Its variables are known. Its outputs can be tested against historical data and validated by a qualified reviewer. Regulators designed that framework with exactly that kind of model in mind.Generative AI operates differently. It produces outputs that can vary significantly based on how a question is framed, what data it was trained on, and what guardrails—if any—have been applied. Validating those outputs at scale is not a straightforward exercise. And in many cases, the generative AI an institution is exposed to is not a tool it selected or configured directly. It is embedded several layers deep inside a vendor platform, a customer service solution, a document processing workflow, or a fraud detection system the institution purchased and largely trusted without a second look.In mortgage banking alone, AI is now embedded in pricing, fraud detection, document analysis, appraisal review, and servicing. The question regulators and examiners are increasingly asking is not whether these tools are being used but whether institutions can defend how they are being used. That means demonstrating that each AI system was identified, risk-rated, tested, governed with clear ownership, and monitored for drift. For most institutions, that standard is aspirational at best.Agentic AI adds another layer of complexity that existing guidance is wholly unprepared to address. These systems do not simply generate responses. They take actions. They make decisions across multi-step workflows with limited human intervention, executing tasks, retrieving information, and in some cases initiating transactions on behalf of users. The governance frameworks most institutions have today were not designed with autonomous AI decision-making in mind, and the gap between what these tools can do and what compliance teams are equipped to oversee is widening.The vendor dimension makes this more urgent, not less. Third-party and supply chain breaches have quadrupled over the past five years, and limited visibility into upstream suppliers consistently ranks as a top cyber risk for financial institutions. When generative AI capabilities are embedded in vendor products, as they increasingly are, the institution inherits the risk without always inheriting the visibility. Contracts have become the primary line of defense, and the institutions best positioned to manage this environment are those that have updated vendor agreements to include mandatory breach notification timelines, clear visibility into subcontractors and fourth parties, explicit terms around data storage and AI training use, and requirements for independent audits rather than self-reported questionnaires.What regulators are communicating, whether intentionally or not, is that they are watching and that they expect institutions to act responsibly in the interim. Footnote 1 of the same guidance preserves the agencies' authority to pursue supervisory action for unsafe or unsound practices. The absence of specific GenAI rules does not remove that authority. It means that when an examiner identifies a problem, the institution will have no formal guidance to point to as a defense. There is only the expectation of sound judgment.Institutions that treat "out of scope" as permission to proceed without governance controls are misreading the moment. The smarter read is that regulators are acknowledging a gap and placing the burden of filling it squarely on the industry. That burden includes knowing what AI tools are operating in your environment, understanding what they are being used for, establishing oversight processes even if they are informal, and being able to demonstrate that outputs are accurate, auditable, and appropriate.None of that requires waiting for a final rule. It requires treating AI governance with the same seriousness that institutions have historically applied to other areas of operational and compliance risk. The footnote is small. The accountability it implies is not.Rafael DeLeon is SVP, industry engagement for Ncontracts, a provider of integrated compliance, risk, and vendor management solutions to the financial industry.