Overview
On November 4, 2026, the Office of the Comptroller of the Currency (OCC) issued a supervisory framework (Framework) for evaluating banks' use of artificial intelligence (AI), which the federal government now refers to as "Super Intelligence" (SI).[1] Directed to OCC examiners, the Framework addresses AI applications across banking activities, including credit decisioning, payments, fraud detection, customer service, operations, and risk management, with a particular emphasis on generative and agentic AI.[2] Although the Framework establishes no new regulatory requirements or supervisory expectations, it offers important insight into how the OCC may evaluate AI-related risks under existing supervisory authorities.
Scope and Framework
The Framework is intended to guide OCC examiners rather than establish a new regulatory regime for supervised institutions.[3]The OCC expressly states that banks are not expected to use the Framework to assess their AI activities or risk management programs, and that it establishes no new supervisory expectations, enforceable standards, or prescriptive requirements.[4] Nor does the OCC expect banks to treat AI as a separate risk category or establish a separate AI risk appetite. Instead, the Framework identifies considerations examiners may apply when assessing AI-related risks within existing supervisory areas, including compliance, model risk management, operational risk, and third-party oversight.
Risk-Based Supervisory Approach
The Framework emphasizes that AI-related risks should be assessed principally by reference to the potential consequences of a system's actions, its degree of autonomy, and the effectiveness of human oversight, rather than its technical sophistication alone.[5]Higher-consequence uses may warrant stronger controls, greater restrictions on autonomous actions, and more direct human intervention.[6] For example, an AI agent authorized to initiate customer transactions may present greater risk than a more sophisticated model limited to internal drafting assistance.
The Framework organizes sixteen supervisory components around six pillars—Purpose, Risk, Control, Oversight, Resilience, and Assurance—which collectively address the permitted scope of AI activities, consequences of failure, safeguards, accountability, operational resilience, and control effectiveness.
Supervisory Considerations for Generative and Agentic AI
Several components are particularly relevant to banks deploying generative and agentic AI. For higher-consequence applications, the Framework highlights the importance of meaningful human oversight, including whether personnel have sufficient information, authority, and practical ability to intervene when necessary.[7] It also recognizes that traditional point-in-time validation may be insufficient for systems whose outputs are nondeterministic or whose behavior changes through model updates, prompts, or third-party modifications.[8]
In addition, agentic systems present distinct cybersecurity concerns, including prompt injection and other attempts to manipulate system instructions or induce unauthorized actions, particularly where agents have access to sensitive information or authority to execute transactions.
The Framework also identifies risks that may not be adequately captured by conventional technology controls, including AI agents that remain operational while taking unauthorized actions, vendor-provided systems whose capabilities change without adequate visibility, and customer-facing applications that generate inaccurate statements or execute actions inconsistent with applicable legal requirements. For banks, these risks have particular significance in activities governed by consumer financial protection laws, including credit decisioning, servicing, collections, and payments. Depending on the circumstances, AI-generated errors or unauthorized actions may implicate existing obligations under fair lending, consumer disclosure, servicing, and other consumer financial protection laws, including prohibitions on unfair, deceptive, or abusive acts or practices. The use of AI does not, by itself, alter the applicability of those requirements.
Illustrative Risk Tiers
The Framework includes a four-tier methodology that examiners may use to evaluate individual AI use cases and calibrate supervisory scrutiny to their potential risks. The methodology considers seven factors: decision consequences, reversibility, customer or financial impact, autonomy, data sensitivity, explainability, and provenance.[9]
The distinction between decision support and autonomous action is particularly important, as is the nature of any human involvement. A system that provides recommendations subject to meaningful human approval presents different risks from an agent authorized to initiate payments, modify customer accounts, or communicate directly with customers while personnel merely monitor its activities. The Framework contemplates progressively more intensive controls as the potential consequences of AI actions increase and meaningful human intervention becomes more limited.
The four illustrative risk tiers are reproduced below, along with their profile characteristics and use cases:[10]
The tiering methodology highlights the importance of assessing AI systems in light of their actual functions and permissions, rather than their underlying technology alone. Changes in an agent's authority, access to customer information, or ability to execute transactions may materially alter its risk profile even without a change to the underlying model.
Regulatory Context
The Framework follows the federal banking agencies' April 2026 revisions to interagency model risk management guidance, which expressly excluded generative and agentic AI models from their scope while recognizing that institutions' existing risk management and governance practices should inform appropriate controls for those technologies.[11] It also follows the Conference of State Bank Supervisors' September 2026 AI Supervisory Framework,[12]which provides state examiners with a risk-based approach to assessing financial institutions' AI activities.
Together, these developments reflect increasing supervisory attention to AI risks, particularly those associated with autonomous systems, while generally relying on existing risk-management and compliance principles rather than imposing new AI-specific regulatory requirements.
Implications for OCC-Supervised Institutions
For national banks and other OCC-supervised institutions, the Framework suggests several practical considerations for managing AI-related risks and preparing for supervisory examinations:
- Prioritize consequential AI use cases. Institutions should focus particular attention on applications that make or materially influence credit decisions, initiate transactions, modify customer accounts, or communicate directly with customers. The scope of an AI system's authority, the reversibility of its actions, and the potential for customer harm may be more significant supervisory considerations than the sophistication of the underlying technology.
- Evaluate whether human oversight is effective in practice. For higher-risk applications, institutions should consider whether personnel have the information, authority, and practical ability to identify errors and intervene before consequential actions occur. Merely designating a human reviewer may not provide meaningful oversight. For autonomous applications, effective oversight may also require the ability to suspend activity promptly, restrict an agent's permissions, and contain erroneous or unauthorized actions.
- Assess consumer compliance and remediation capabilities. AI systems used in lending, servicing, payments, collections, and customer communications should be evaluated for their ability to comply with applicable consumer financial protection requirements. Institutions should also consider whether they can identify affected customers, reconstruct erroneous actions, and implement appropriate corrective measures when failures occur.
- Address AI-specific third-party risks. Institutions relying on vendor-provided AI capabilities should consider whether existing diligence, contractual protections, and monitoring adequately address changes in AI functionality, permitted data use, agent permissions, auditability, and responsibility for errors or customer harm. Particular attention may be warranted to notice of material changes in AI functionality, restrictions on the use of bank data for model training, incident notification, and allocation of responsibility for AI-related losses.
- Be prepared to demonstrate the effectiveness of existing controls. Although institutions are not expected to adopt the OCC's sixteen-component framework, they should consider whether existing documentation and examination materials adequately demonstrate how consequential AI applications are approved, tested, monitored, and controlled. Depending on the use case, relevant materials may include risk assessments, defined limits on autonomous actions, testing and validation results, escalation and override procedures, and records of incidents and remediation. Institutions should focus on whether existing governance and control processes adequately address the risks of their AI deployments, rather than treating the Framework as a new supervisory checklist.
The Framework signals an important evolution in supervisory attention from the risks associated with AI-generated outputs to the consequences of actions that AI systems are authorized to take. For OCC-supervised institutions, the central consideration is whether existing governance and controls remain effective as AI applications move beyond decision support toward increasingly autonomous, customer-impacting activities. Although the Framework creates no new obligations, it provides a useful indication of how examiners may evaluate that question.
[1] See Super Intelligence: Supervisory Framework, OCC Bulletin 2026-54, Off. of the Comptroller of the Currency (Nov. 4, 2026), https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-54.html.
[2] Off. of the Comptroller of the Currency, OCC Supervisory Framework on Bank Use of Super Intelligence (2026) ("Framework").
[3] See Super Intelligence: Supervisory Framework, OCC Bulletin 2026-54, Off. of the Comptroller of the Currency (Nov. 4, 2026), https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-54.html.
[4] See id.
[10] See id. at 15.
[12] See Benjamin Saul & Vito Arethusa, State Financial Regulators Release AI Supervisory Framework, Steptoe (Oct. 8, 2026), https://www.steptoe.com/en/news-publications/steptechtoe-blog/state-financial-regulators-release-ai-supervisory-framework.html.
