PwC Banking AI Framework Maps Five Gaps SR 26-2 Left Unresolved

What happened

Why it matters

• ·Banks that have launched SR 26-2 implementation programs without resolving scope and proportionality questions face compounding risk: applying uniform legacy model risk controls to generative AI systems produces both over-governance of low-risk tools and under-governance of high-risk ones, a mismatch that supervisors are beginning to examine directly.
• ·The three-lines-of-defense framing matters for compliance program design because it forces explicit allocation of AI validation and oversight responsibility across first, second, and internal audit functions, an allocation most banks have not yet formalized for AI systems sourced from third-party vendors.
• ·Third-party and foundation model risk is the least mature of the five challenges PwC identifies, and it is also the area where regulatory expectations are evolving fastest; banks that rely on vendor-provided AI without independent validation controls are exposed to both supervisory findings and vendor-driven model changes they cannot govern.

Governance controls affected

What to do now

• ☐Map each AI system in your model inventory against PwC's five challenge areas to identify which governance gaps are most acute for your institution.
• ☐Review your three-lines-of-defense policy to confirm that AI validation responsibilities are explicitly assigned and that internal audit has the technical competency to challenge model risk assessments for generative AI.
• ☐Audit your proportionality framework: confirm that AI systems are tiered by risk level and that oversight intensity is calibrated to tier, not applied uniformly from legacy model risk policy.
• ☐Assess third-party AI vendor contracts against the validation gap PwC identifies: verify that contracts give your institution enough access to model documentation and change notification to support independent re-validation.
• ☐Brief your board risk committee on the five-challenge framework and confirm that AI risk appetite statements explicitly address generative AI and externally sourced models, not just internally developed quantitative models.

What to watch next

U.S. banks should monitor supervisory communications from the Federal Reserve and OCC for further SR 26-2 implementation guidance, particularly on how examiners will treat AI-specific validation methods and third-party model dependencies. The OCC Model Risk Management: Revised Guidance (Bulletin 2026-13) represents a parallel track of regulatory pressure, and future examination findings under that bulletin will signal which of PwC's five areas regulators are prioritizing in practice. International institutions should also watch for EU supervisory guidance on AI model risk, which may impose additional validation and documentation requirements on top of existing model risk frameworks.