OCC Tells Bank Examiners to Judge AI by What Can Go Wrong, Not How Advanced It Is

The OCC issued the framework on November 4 as Bulletin 2026-54, titled "Super Intelligence: Supervisory Framework". It covers national banks, federal savings associations and the federal branches and agencies of foreign banks. The OCC uses "super intelligence", or SI, as its term for the technologies previously covered by the statutory definition of artificial intelligence, together with their fast-advancing capabilities. The bulletin cites Executive Order 14434.

Banks are putting AI agents to work in payments, lending and fraud control, and the document is the clearest guide yet to what federal examiners will ask about those uses. The bulletin says the framework "does not establish supervisory expectations for banks". It creates no enforceable standards and is not meant for banks to assess themselves. What it does set out is how examiners should weigh each use case: by its potential consequences, how much agency has been handed to the system and how much human oversight remains, "rather than the technical sophistication of the SI used."

The regulator said examiners "should not treat SI as a separate and distinct risk category", and that banks do not have to set a separate risk appetite for it. Instead, considerations specific to AI are meant to sit on top of the model risk, governance, technology, compliance and operational risk practices banks already have. The bulletin says "control intensity could increase with the potential consequences of an SI agent's failure or misuse." In the OCC's announcement, the agency described this as a technology-neutral approach: banks using AI face the same tests of safe and sound operation and legal compliance as they do for any other activity.

According to an analysis by the accounting and advisory firm Forvis Mazars, the 22-page framework groups 16 components under six pillars and includes an illustrative four-tier risk scale. On that reading, the top tier covers systems that act directly, can be hard or impossible to reverse, carry high financial or customer impact and run fully or partly on their own. Its examples include autonomous payment agents, real-time credit decisions, the release of fraud holds and market access. The lowest tier covers internal productivity tools, code assistants and employee question-and-answer tools that touch no customer or financial data and take no direct action.

Forvis Mazars said examiners would expect higher-risk uses to have kill switches, tested fallbacks and a way to put customers right after a failure. It also said a bank's AI inventory should include AI features that existing vendors build into their products, and that accountability for those features "generally remains with the bank." The firm noted that, in practice, a simple rules-based agent that can move money may draw more scrutiny than a sophisticated model that only drafts internal documents.

The OCC said examiners may apply the framework to community banks, tailoring reviews to a bank's size, complexity and risk profile and to the autonomy and consequences of how it uses AI. The bulletin is signed by James M. Gallagher, senior deputy comptroller and chief national bank examiner.

The OCC said it plans to update the framework regularly as the technology, the ways banks use it and supervisors' understanding develop, and as it receives feedback from stakeholders.