The cadence stopped being prescribed. The drift did not stop.
Validation is not a milestone, it is a lifecycle. A model validated in March is not the model answering in June if the provider shipped in between, and the question a validation team has to answer is whether anyone would know.
No compliance claim under these frameworks. iTmethods makes no compliance, certification or accreditation claim under SR 26-2 or any other framework named on this page. Beyond SOC 2 Type II for Reign Ops, no other certification or accreditation is claimed.
More on what we do not claim
We are not certified against, accredited for, or approved under any of them. Alignment is not compliance. The determination belongs to your own risk function, and nothing here transfers it to us. No authority responsible for any of them endorses, approves or recommends Reign or iTmethods.
Pre-deployment to decommissioning, with evidence at each phase.
Every phase produces evidence, and the phases that produce none are the ones that fail an examination.
Validated
What was tested, against what, and what the result was. Held as a record rather than reconstructed from a validator’s notes when someone asks.
Where does your last validation live?
Versioned
Which version of which model was in production on a given day. Without that, a finding about behavior cannot be tied to the thing that produced it.
Could you answer that for last quarter?
Change-controlled
Prompt revisions, routing changes and policy edits are model changes. Under change control they are events; outside it, the validated model and the running model drift apart quietly.
Who can change one today?
What is allowed to run, and on whose authority.
A model inventory that lists what exists is a document. A registry that governs what may run is a control.
An inventory
Lists what exists. At examination it tells a regulator what you believe you have.
A registry tied to the path
Governs what may run. At examination it tells them what actually ran, which is the question that gets asked second and answered badly.
In Reign Gateway, the models and tools approved for each identity work as that registry for traffic sent through it: each person or agent reaches only what you approve, and each call is recorded.
The obligations these frameworks share.
SR 26-2, the EU AI Act and the NIST AI RMF ask for different documents and much the same underlying evidence.
SR 26-2, issued 17 April 2026 by the Federal Reserve, the OCC and the FDIC, supersedes SR 11-7 and SR 21-8.
| SR 11-7 asked for | SR 26-2 says instead |
|---|---|
| A periodic review of each model “at least annually but more frequently if warranted”. | The timing, nature and frequency of validation activities vary with model purpose, methodology, the scope of model changes and data limitations. |
On generative and agentic systems SR 26-2 is explicit:
“Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance.”
That is why evidence produced by the path matters more than evidence assembled for the file.
For federally regulated institutions in Canada, the model risk instrument is OSFI E-23 →
The assessment against any of these rests with your validation function and your examiners. Reign produces the operating record their judgment draws on.
Discuss the review and validation evidence for one model.
We will look at what evidence exists across its lifecycle today, and where the gap between the validated model and the running one actually opens.