Your examiner asked for proof of what your AI did.
Your policy and your model inventory spreadsheet are not enough. The examiner wants the record: who approved which system, on what evidence, under whose authority, and what changed since. If you pull that together after the request arrives, it is a reconstruction. An examiner who has seen a hundred of them can tell.
For banking organizations over $30bn in assets, under the revised interagency model risk guidance (SR 26-2, 17 April 2026, superseding SR 11-7 and SR 21-8). Coriqo is an independent record. It is not a control in your model's path, so your systems never depend on it to run. It works alongside the email, calendar and CSV files your risk team already uses.
How the rest of Coriqo works for banks and credit unions: Coriqo for financial institutions.
What the request actually asks for
SR 26-2 replaced fifteen years of SR 11-7 in April 2026. It went in a direction few banks planned for: less prescriptive. The annual validation cadence is gone. Documentation and inventory now depend on materiality. The guidance states plainly that it sets no enforceable standards.
Read quickly, that sounds like relief. An examiner reads it the other way. When the regulator stops specifying the standard, you are assessed against the one you set for yourself. The only evidence that you held to it is the record you were keeping at the time.
Your AI agents sit outside the model risk framework
SR 26-2 excludes generative and agentic AI from its scope. The stated reason is that both are new and changing fast. The agencies say they will issue a request for information on AI later. Until then, banks are told to apply their "broader risk management and governance practices" to these systems.
That one sentence moves every agent you run out of a framework with fifteen years of examiner precedent. It lands them in general safety and soundness, where there is no template, no schedule and no agreed evidence standard. You have to define what good looks like. The first examiners to ask about agents will not be checking your work against a rulebook. They will ask what you decided, when you decided it, and what you have that shows it.
You cannot build this record backwards
Every document produced after the request has the same flaw: its own file details say when it was made. An examiner does not have to accuse anyone of anything. A governance file created the week the exam opened simply counts for less.
Coriqo puts the check in the examiner's hands. Each governance event is added to a tamper-evident log as it happens. Events include an approval, a validation sign-off, a risk rating or a model change. Each one is linked to the one before, and the log is periodically sealed with a signed checkpoint (a Merkle checkpoint). Your examiner receives the record plus a verifier and an Ed25519 public key, and checks the dates against the seal themselves. They do not have to trust your word or ours.
What is already in force, and what comes next
The supervisory deadline is the one with no date on it. State AI laws come on top of it. Each has its own notice, assessment and recordkeeping duty. Each asks, in its own words, for the same underlying record.
Dates are drawn from Coriqo's regulatory corpus and are provided for orientation, not as legal advice. Browse the full obligation set.
What the paid pilot is
It is a defined engagement with a fixed fee, run inside your own Coriqo account. It ends with your agents on the record and an evidence package you can hand an examiner, not with a slide deck.
Getting governed, then agent assurance
Typically around $50,000 for the pair, fixed fee, quoted after a scoping call. No hourly rate, no open-ended retainer, and no charge for the scoping call itself.
Everything runs inside your environment. Nothing runs from our side. Where your environment blocks a test, the report says inconclusive for that test and gives the reason. A report that fakes certainty is worth less than one that names its gaps. Both engagements run in your own Coriqo account and need an active subscription, which the scoping call covers. Full engagement definitions.
Find out what your examiner would find
A 30-minute readiness review against the SR 26-2 request list, including the agent systems it moves outside the model risk framework. We cover what you could produce today, what you would have to reconstruct, and which gaps are cheap to close before the next exam cycle. No slide deck, and no separate discovery call first.