What to do about SR 26-2

SR 26-2 replaces checklist compliance with principles-based defensibility. That demands three things from an institution, in order:

1. Get the organization right, because judgment-based supervision puts weight on people rather than checklists.
2. Get the technology right, because principles only scale on a platform that can enforce them.
3. Get the processes right, because continuous defensibility cannot be assembled after the fact.

Every tactical choice sits inside one of these three. Skip any of them, and the rest does not compound.

1. Get the organization right

The shift most institutions need to make is not structural. It is posture.SR 26-2 shifted the supervisory conversation from rule-following to judgment. That shift rewards institutions with MRM leadership that can defend a risk posture on its own terms rather than against a checklist. In practice, that means a CRO who owns the aggregate risk view, an MRM function whose independence is measured by rigor rather than reporting line, and a model risk management framework that brings GenAI under the same oversight without duplicating infrastructure.

A governance function that has spent 15 years producing evidence for regulators now has to produce evidence for itself in a form it can defend when the question is not 'what does the rule say' but 'what does your risk appetite actually tolerate.'

2. Get the technology right

The platform has to be one thing, across classical models, rule-based systems, spreadsheets, and GenAI, with governance running through all of it as a first-class property rather than an add-on. Principles-based governance only scales on a platform that can enforce policies authored by risk teams, automatically capture evidence, and track dependencies across the full model lifecycle, including the systems SR 26-2 excluded. Spreadsheets and rule-based systems belong in the same inventory as ML models, because that is where errors happen. GenAI belongs in a parallel bridge track in the same platform, because the CRO's view has to be unified.

The failure mode for most institutions is a GRC tool that handles paperwork, a separate platform that runs the models, and a spreadsheet in between that nobody owns. SR 26-2 tolerates that architecture. A future regulation may not.

3. Get the processes right

Governance has to be an attribute of the work, not an approval stage at the end. The workflow from model intake through validation, deployment, monitoring, and retirement has to carry that discipline through every step.Risk teams author policy. The platform enforces it. Validators sit close enough to developers to catch problems early. Documentation accumulates as a byproduct of the work rather than as a parallel exercise assembled at the end.

SR 26-2 calls this shifting governance into the development lifecycle rather than bolting it on at the end, and now gives that architecture explicit supervisory cover. For institutions still running a traditional handoff model, the process change is the hardest of the three because it touches how data scientists and validators actually do their jobs. It is also the one that compresses validation timelines the most once it is working.

How Domino makes this operational

The Domino Enterprise AI Platform is where the organizational roles, technology requirements, and process changes can all run, with each phase producing a defensible artifact by the end. SR 26-2 shifted the burden of proof to the institution. The Domino Enterprise AI Platform is how you carry it – enforcing the policies your risk teams write, capturing evidence as models run, and giving the CRO a unified view across classical models, rule-based systems, and GenAI.

Built for every regulation

SR 26-2 is a starting point, not an arrival. The regulation has moved, and it will move again. With state and international frameworks tightening, and architecture built to match exactly one regulation will be rebuilt for the next one.

The institutions that will lead the next cycle are those whose governance functions treat adaptability as offense rather than overhead – organization that can flex, technology that can extend, processes that can absorb change. That is what SR 26-2 is asking institutions to build and what Domino makes possible. The real advantage isn't surviving this regulation. It's knowing you won't have to rebuild for the next one.

The framework is here. The next step is putting it into practice. Join us at Rev New York on May 19th, where David Palmer, author of SR 11-7, is keynoting and I'll be leading a panel with MRM leaders from Capital One, TIAA, and New York Life. Register now →

Part 1: What changes with SR 26-2
Part 2: How to navigate SR 26-2
Part 3: What to do about SR 26-2