OCC Tells Bank Examiners to Rank AI Use by Consequence, Not Sophistication

The Office of the Comptroller of the Currency on November 4 released a supervisory framework that tells its examiners how to evaluate banks' use of generative and agentic AI. The framework was issued with OCC Bulletin 2026-54. It was signed by James M. Gallagher, Senior Deputy Comptroller and Chief National Bank Examiner.

The OCC calls the technology "Super Intelligence" (SI). The framework says the term covers what was previously called artificial intelligence and cites Executive Order 14434. A footnote says the framework was prepared with the assistance of SI and that a human reviewed, edited and approved the content.

What the framework says

The framework's central principle is that a bank's control intensity could rise with the potential consequences of an agent's failure or misuse. Risk classification may rest on potential consequences, transfer of agency and the degree of human oversight, not technical sophistication. As an example, it says a simple rules-based agent authorized to initiate transactions could present greater risk than a sophisticated model limited to internal drafting.

The document sets out sixteen components grouped into six pillars: purpose, risk, control, oversight, resilience and assurance. It also offers an illustrative four-tier scheme. Tier 1 (critical) covers autonomous payment agents, real-time credit decisioning, fraud-hold release and market access. Tier 2 (high) includes AI-assisted underwriting, agent-initiated customer communications and AML alert disposition. Tier 3 covers uses such as internal summarization of credit memos, and Tier 4 covers low-risk internal productivity tools. The OCC says a fully autonomous, customer-facing payment agent sits at Tier 1 regardless of how well it performs in testing.

Several passages speak directly to legal and compliance teams:

• On scope, the framework says "Activity outside the approved purpose may be treated as a control failure even when the resulting output or action appears reasonable."
• On vendors, it says accountability for managing a bank's risk generally remains with the bank even when development or hosting is spread across providers. It suggests banks consider how contracts allocate responsibility for model-related errors or losses, including customer harm, and whether to require notice when vendors add AI features or change models.
• On compliance, it flags hallucinations about fees, rates, account status or policies as a source of legal or customer-harm exposure.
• On resilience, it notes an agentic system can remain available while acting incorrectly. It lists circuit breakers, rate limits, least-privilege permissions and kill switches as possible containment tools, and it addresses external agents that customers or fintechs operate through bank channels.
• On documentation, it says records of inputs, outputs, retrieved sources, tool calls, approvals and overrides may allow a bank to reconstruct a material decision.

What it does not do

The OCC states that examiners should not treat SI as a separate and distinct risk category and that banks are not required to define a separate SI risk appetite. The OCC said the framework does not establish supervisory expectations for banks, and banks are not expected to use it to assess their own SI use or risk management. The document says it should be updated regularly.

Reuters, which first reported the framework, noted that while the document is not legally binding like a rule, banks typically comply closely with such guidance. For community banks, examiners may use the framework and should tailor reviews to the bank's size, complexity and risk profile. The ABA Banking Journal reported the OCC said examiners will apply it to AI used in credit decisions, payments, fraud detection, customer service, operations and risk management.

In April, the OCC, the Federal Reserve and the FDIC updated their model risk management guidance in OCC Bulletin 2026-13, which left generative and agentic AI out of scope. The new document's first footnote says the earlier OCC Bulletin 2026-13 principles apply to non-generative and non-agentic models, so the new framework is more applicable to generative and agentic systems.

What this means for in-house counsel

Treat the bulletin as a preview of examiner questions, not as a compliance checklist. The OCC says it is not a self-assessment tool, but it describes the evidence examiners may look for. Counsel at national banks may want to confirm that the business keeps an inventory of AI use cases, including features vendors switched on through product updates. The framework says an inventory may capture use case, owner, provider, permissions, deployment status, monitoring and fail-over. Because the OCC says out-of-scope activity can be a control failure even when the output looks reasonable, written purpose statements matter. Lawyers should help draft them so they can be tested.

Revisit vendor contracts next. The framework puts accountability on the bank, so agreements with core processors, fraud vendors and AI providers should be checked for notice of model changes, AI-specific incident definitions and notification timelines, data-use limits and allocation of liability for AI errors and customer harm. Where a bank allows or blocks customers' outside AI agents, the position should be documented and the access terms and fraud controls should match it.

Finally, test the human oversight claims. The framework warns that bulk approvals and high volumes can reduce review quality, and that a named reviewer needs the competence and authority to halt a system. Legal and compliance teams should ask whether reviewers can actually intervene, whether kill-switch and fallback procedures have been exercised, and whether logs could reconstruct a disputed decision.