SR 26-2 and the documentation problem agentic AI creates

Model risk management guidance was written for a world where a model produced a score, a person reviewed it, and the review left a paper trail. Agentic AI breaks each of those assumptions. The system takes actions, chains them, and often completes work with no human in the loop at the moment of consequence.

That changes what documentation has to cover. A model card describes what a system is. Supervisors increasingly need records of what a system did, at a specific time, on a specific input, with a specific outcome.

What examiners are actually asking for

Across model risk practice, the recurring requests reduce to four questions:

• What decided? The system, version, and configuration in force at decision time.
• What did it decide? The output, the confidence, and the inputs it relied on.
• Who was accountable? Human review, override, or the documented absence of both.
• How do you know the record is intact? Whether the evidence could have been edited after the fact.

The first three are usually answerable from application logs. The fourth is where most institutions have nothing, because logs are written by the same party being examined and can be regenerated at will.

Why logs are weak evidence for autonomous action

A log entry proves that a system wrote a line. It does not prove the line was written when it says it was, or that the line has not been rewritten since. For human-in-the-loop workflows that gap is usually tolerable, because a person's contemporaneous record corroborates the system's. Remove the person and the corroboration goes with them.

This is the structural problem: the party producing the evidence is the party whose conduct is in question. The witness is vouching for itself.

What independent evidence looks like

The alternative is to bind each consequential action to a record that the operator cannot alter after the fact:

• Sign the decision record at decision time, with a key the application does not hold.
• Anchor the signature to a public ledger, so the timestamp is witnessed by parties with no stake in the outcome.
• Publish verification openly, so an examiner, counterparty, or court can check the record without asking the institution for anything.

That last property is what turns a record into evidence. If verification requires the institution's cooperation, the institution's cooperation is what is being trusted.

Retention horizons and the quantum question

Supervisory records are kept for years, and litigation can reach back further. Signatures made today with classical elliptic-curve cryptography are expected to remain sound for a long time, but "harvest now, decrypt later" is a live consideration for anything with a decade-plus retention horizon. Rubric signs attestations with ML-DSA-65, a NIST-standardized post-quantum algorithm, so the evidence does not inherit an expiry date from its cryptography.

Practical starting point

Institutions rarely begin by attesting everything. The common first scope is the set of decisions that would be expensive to be unable to prove: adverse actions, autonomous approvals above a threshold, model version changes, and incidents. Each becomes a signed, anchored record with an independent verification path, while the rest of the estate keeps logging as it does today.