Regulatory
The regulatory context, with the product claim kept separate.
The cited sources provide regulatory context. GRACE is presented as a company control architecture for institutions applying their own rules.
Institution-defined rules.
Runtime evidence.
GRACE applies institutional controls at the Context Path and Action Path and records the authorization evidence.
SR 26-2 · Federal Reserve, OCC, FDIC · April 17, 2026
Agentic AI sits outside the guidance's stated scope.
“Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance.”
Footnote 3 also states that a banking organization's own risk-management and governance practices should guide the determination of appropriate controls for tools, processes, or systems outside the guidance. GRACE is presented here as a company control architecture for institutions applying their own rules.
Primary sources: Federal Reserve SR 26-2 · Interagency guidance attachment.
EU AI Act timeline
Regulation (EU) 2026/1744 entered into force on July 27, 2026. It amended Article 113 of the EU AI Act so that Chapter III, Sections 1, 2, and 3 generally apply from December 2, 2027 for high-risk AI systems classified under Article 6(2) and Annex III, and from August 2, 2028 for high-risk systems classified under Article 6(1) and Annex I.
Primary source: EUR-Lex — Regulation (EU) 2026/1744.
Product position
The regulation provides external context; GRACE product claims are based on the company's control architecture and technical materials.
Regulatory context is kept separate from product claims.
Verified reference points
- April 17, 2026SR 26-2 issued jointly by the Federal Reserve, OCC, and FDIC.
- July 27, 2026Regulation (EU) 2026/1744 entered into force.
- December 2, 2027Application date established by Regulation (EU) 2026/1744 for the specified Annex III high-risk provisions.