Introduction
The U.S. Office of the Comptroller of the Currency (OCC) has released supervisory guidance in order to assist bank examiners to assess the use of artificial intelligence (AI) by financial institutions, including those which can operate with minimal human intervention.
Released on November 4, 2026, this guidance highlights the various factors that the bank examiners need to consider regarding AI risks as part of the existing bank supervision. There is no separate risk category related to AI risks.
Titled Super Intelligence: Supervisory Framework, the document applies to national banks, federal savings associations, and federal branches and agencies of foreign banking organizations overseen by the OCC. It covers AI and agentic AI used in ordinary business activities, including payments, credit decisions, fraud detection, customer service, operations, risk management, and market activities.
OCC Places AI Within Existing Risk Oversight
The framework supplements supervisory considerations covering model risk management, AI governance, technology, compliance, and operational risk. Its sixteen components describe how AI may affect these control areas and help examiners apply risk-based supervisory judgment.
Source: Whale Insider
Each use case must be evaluated on the basis of its nature, significance, and consequences of any system malfunction or misuse. They should also consider how much decision-making authority a bank has delegated to an AI system and what oversight remains.
Banks are not being directed to create a separate AI risk category. Instead, AI exposures should be considered through existing risk management structures.
AI Authority Matters More Than Model Complexity
The OCC distinguishes an AI system’s technical sophistication from the authority it receives. A relatively simple agent allowed to initiate financial transactions, for example, could pose greater risk than a sophisticated model used only for internal analysis.
Examiners should consider what a system is permitted to do, which decisions it can make and what could happen if its output is incorrect or it is misused. Technical complexity alone should not determine its risk classification.
This distinction applies across banking activities. A tool that supports an employee’s analysis may present a different risk from an agent authorized to execute a payment.
Higher-Risk Applications May Need Closer Oversight
The framework says applications with potentially serious consequences may warrant tighter limits on autonomy and more direct human supervision. It also identifies stronger controls, independent validation, and more robust resilience measures as considerations for higher-risk uses.
The OCC is not prescriptive when it comes to the measures that must be put in place for each particular application of artificial intelligence. Human involvement is particularly relevant when an agent can take action rather than simply provide information or recommendations.
Examiners will consider the permissions granted to a system, how its activity is monitored, and what safeguards apply if it operates incorrectly.
Guidance Considers Banks’ Different Risk Profiles
Examiners are instructed to account for each institution’s size, complexity and risk profile, including community banks.
The OCC said it intends to update the framework regularly as AI develops and in response to stakeholder feedback.
Global Supervisors Are Increasing AI Scrutiny
The announcement comes as banking regulators in several jurisdictions ask lenders more questions about AI. Reuters has reported that authorities are examining how financial institutions deploy advanced models, what limits they place on those systems and how they monitor their use.
Reported concerns include cybersecurity and potential financial stability risks. U.S. regulators have also asked banks about advanced AI models and safeguards governing them.
Frequently Asked Questions
What did the OCC announce on November 4, 2026?
It issued a framework to guide examiners reviewing banks’ use of AI and agentic AI in ordinary business activities.
Does the OCC treat AI as a separate banking risk?
No. The guidance says AI should not be treated as a distinct risk category, and banks should not be required to set a separate AI risk appetite.
What controls may higher-risk AI systems need?
They may require tighter autonomy limits, stronger controls, independent validation, resilience measures and closer human oversight.
Conclusion
The OCC’s framework gives examiners a risk-based method for reviewing banks’ AI use without creating a separate supervisory category. It focuses on each application’s purpose, delegated authority and potential consequences if it fails or is misused. The guidance places controls, validation, resilience and human oversight within existing expectations for safe and compliant banking, with updates planned as AI develops.
