The Office of the Comptroller of the Currency (OCC) has taken another important step in addressing the rapidly expanding use of artificial intelligence in the banking industry. On November 4, 2026, the OCC issued a new supervisory framework designed to assist its bank examiners in evaluating banks’ use of what the agency, following the terminology adopted by the Trump Administration, calls “Super Intelligence” (SI). The framework focuses particularly on generative AI and agentic AI and provides examiners with a detailed roadmap for evaluating the risks associated with these technologies and the controls banks have implemented to manage those risks.
Importantly, the OCC emphasizes that the framework is intended as a resource for examiners, not as a source of new regulatory requirements for banks. It does not establish a separate category of supervisory risk for SI, require banks to adopt a separate SI risk appetite, or impose new enforceable standards. Rather, it directs examiners to consider how the use of SI may introduce, amplify, or modify risks that banks already manage under established supervisory frameworks.
That distinction is significant, particularly at a time when financial institutions are seeking greater regulatory clarity concerning the use of generative and agentic AI.
The OCC’s approach: Technology-neutral supervision rather than a new regulatory regime
The new framework implements the OCC’s commitment to encourage responsible technological innovation while maintaining the safety and soundness of the banking system and compliance with applicable laws and regulations.
The OCC recognizes that SI can provide substantial benefits to banks and their customers, including more efficient customer service, improved fraud detection, stronger cybersecurity, reduced operational costs, and greater automation of manual processes. At the same time, the agency acknowledges that the rapid evolution of generative and agentic AI presents risks that may not be adequately addressed by controls developed for traditional technologies.
The OCC makes clear, however, that examiners should not treat SI as a separate and distinct risk category. Nor should banks be required to establish a separate SI risk appetite. Instead, SI-related risks should be incorporated into existing risk-management frameworks, including those addressing operational risk, compliance risk, credit risk, model risk, cybersecurity, privacy, and third-party relationships.
This approach is consistent with the OCC’s broader emphasis on technology-neutral supervision. The agency intends to evaluate the risks presented by a particular application rather than impose restrictions merely because a bank employs a new or sophisticated technology.
The OCC also emphasizes proportionality. Examiners should exercise judgment based on the bank’s size, complexity, risk profile, and the nature and potential consequences of its particular SI applications.
Six pillars and sixteen components
The framework identifies six principal pillars around which examiners should organize their evaluation of a bank’s use of SI:
- Purpose – Establishing the actions that an SI system or agent is authorized to perform.
- Risk – Assessing the consequences if the system’s output or actions are inaccurate, inappropriate, or otherwise unsuitable.
- Oversight – Identifying who monitors the system and who is accountable for its use.
- Resilience – Ensuring that the bank can detect, contain, recover from, and remediate system failures while maintaining critical operations.
- Assurance – Establishing that controls continue to operate effectively through testing, documentation, independent review, and third-party oversight.
The OCC translates these six pillars into sixteen supervisory components, addressing such matters as governance and accountability, model risk management, data governance, privacy, compliance, vendor risk, operational resilience, cybersecurity, performance monitoring, testing, documentation, internal audit, and reporting.
Although many of these subjects are familiar to bank compliance and risk-management professionals, the framework identifies important considerations arising from the distinctive characteristics of generative and agentic AI.
For example, the OCC recognizes that conventional model validation may be insufficient for systems that produce non-deterministic outputs, undergo frequent changes, or rely on third-party foundation models. It therefore encourages testing that takes account of changing model behavior, hallucinations, adversarial inputs, and the possibility that a system may behave differently when exposed to similar prompts.
The framework also recognizes that an AI system may continue operating normally from a technical standpoint while taking inappropriate or harmful actions. Banks therefore should consider safeguards such as circuit breakers, rate limits, restricted permissions, fallback procedures, and mechanisms for suspending or terminating an agent’s activities.
The significance of agentic AI and human oversight
One of the most important aspects of the framework is its recognition that the risks associated with AI depend not simply on the sophistication of the underlying technology but also on the degree of autonomy the system possesses and the consequences of its actions.
The OCC explains that a relatively simple rules-based agent authorized to initiate transactions may present greater risk than a sophisticated model used solely for internal drafting assistance.
The framework distinguishes between human-in-the-loop controls, under which a human reviews and approves an output or action before it is implemented, and human-on-the-loop controls, under which a human actively monitors an independently operating system and has the practical ability to intervene.
The degree of human involvement should be calibrated to the potential consequences of the system’s actions, the extent of its autonomy, and the reversibility of those actions.
Importantly, the OCC cautions against treating human oversight as a merely formal exercise. A designated reviewer must have the necessary expertise, information, authority, and capacity to evaluate, reject, modify, or halt the system’s actions. A nominal approval process that amounts to little more than clicking a button will not necessarily provide meaningful oversight.
These considerations are particularly important as banks move beyond using generative AI as an internal productivity tool and begin deploying agents capable of interacting with customers, accessing accounts, initiating transactions, and performing other functions with limited human intervention.
Consumer compliance receives particular attention
Of particular interest to the consumer financial services industry is the framework’s treatment of consumer compliance risk.
The OCC expressly recognizes that SI used in customer service, marketing, servicing, collections, disclosures, and other consumer-facing activities can create compliance risks when outputs are materially inaccurate, misleading, or inconsistent with the terms of the bank’s products.
The framework specifically identifies hallucinations concerning fees, interest rates, account status, and bank policies as potential sources of legal liability and customer harm. Banks are encouraged to implement controls that limit automated representations, require verification in higher-impact situations, and facilitate prompt correction and remediation when inaccurate information is provided.
This is an important recognition of the practical challenges associated with deploying generative AI in consumer financial services. A customer-service agent that confidently provides incorrect information about an account balance, payment obligation, interest rate, or fee can create consequences that extend beyond customer dissatisfaction. Depending on the circumstances, the conduct could implicate existing federal and state consumer financial protection laws.
The OCC also recognizes that the use of SI does not change a bank’s underlying legal obligations. Rather, banks must ensure that their use of the technology is consistent with applicable laws and regulations.
That observation should be kept in mind by institutions considering the use of AI in lending, servicing, debt collection, marketing, and other regulated activities. The fact that an inaccurate representation or improper action was generated by an AI system rather than a human employee does not eliminate the institution’s responsibility for compliance.
Third-party service providers present additional challenges
The framework devotes considerable attention to third-party and vendor risk. This is understandable because many banks obtain their SI capabilities from outside providers rather than developing the underlying technology themselves.
The OCC recognizes that conventional service-level agreements and information-security reviews may not adequately address the risks associated with third-party SI systems.
Among other things, the framework encourages banks to consider:
- The extent to which a provider’s agents can access bank systems, customer information, and other data.
- Whether the bank has adequate visibility into the activities of provider agents.
- Whether vendor contracts adequately address responsibility for model-related errors and resulting customer harm.
- Whether vendors must provide advance notice of material changes to models or AI functionality.
- Whether banks have sufficient rights to monitor, test, restrict, or terminate the use of third-party systems.
The last point is particularly important. A vendor may introduce new AI functionality into an existing product without the bank necessarily appreciating the resulting changes in risk. Banks should therefore consider whether their existing vendor-management procedures and contractual arrangements adequately address changes in AI functionality, including changes that occur after initial deployment.
A graduated risk-tiering approach
The framework also includes an illustrative risk-tiering methodology designed to help examiners evaluate the intensity of controls appropriate for different SI applications.
It identifies four tiers:
- Tier 1 – Critical risk: Autonomous or partially autonomous systems involving direct actions, limited reversibility, and potentially significant customer or financial consequences. Examples include autonomous payment agents and real-time credit decisioning.
- Tier 2 – High risk: Systems involving direct actions or significant decision support with human monitoring. Examples include SI-assisted underwriting and agent-initiated customer communications.
- Tier 3 – Moderate risk: Decision-support applications involving mandatory human review and limited data sensitivity.
- Tier 4 – Low risk: Internal productivity applications that do not involve customer or financial data exposure or direct action.
The methodology considers several factors, including the consequences of a decision, reversibility, customer and financial impact, autonomy, data sensitivity, explainability, and the provenance of the system.
The underlying principle is straightforward: the more consequential and autonomous the activity, the more extensive the controls should be.
Importantly, the OCC describes this as an illustrative methodology for examiners. It is not a mandatory risk-classification system that banks must adopt.
What does the framework mean for banks?
The OCC’s November 4 issuance should be viewed as an important supervisory development, but not as the adoption of a new AI regulatory regime.
In its accompanying OCC Bulletin 2026-54 the agency expressly states that the framework does not establish supervisory expectations for banks, is not intended to create new regulatory expectations, and does not establish enforceable standards or prescriptive requirements. Banks are not expected to use the document to assess their SI activities or SI risk-management programs.
Nevertheless, banks should not disregard the framework. It provides a useful indication of the issues OCC examiners may consider when evaluating the use of generative and agentic AI during examinations. Institutions would be well advised to understand the framework and consider whether their existing risk-management and compliance programs adequately address the issues it identifies.
The issuance also is significant in the context of the OCC’s revised model risk management guidance issued earlier this year. That guidance, OCC Bulletin 2026-13 expressly excluded generative and agentic AI from its scope because of the novel and rapidly evolving nature of those technologies. The new framework provides examiners with additional tools for evaluating those technologies without converting the framework into a new set of enforceable requirements.
Finally, the OCC characterizes the framework as a living document that it expects to update regularly as the technology, its applications, and supervisory understanding evolve. The agency also invites stakeholder feedback.
Bottom line
The OCC deserves credit for recognizing both the substantial potential benefits of generative and agentic AI and the need to address the risks associated with their deployment in banking.
Rather than attempting to regulate the technology through a separate set of prescriptive requirements, the OCC has elected to apply established risk-management principles in a manner that takes account of the distinctive characteristics of these new technologies. Its emphasis on proportionality, the consequences of particular use cases, meaningful human oversight, and technology-neutral supervision is a sensible approach.
For the consumer financial services industry, the most consequential message is that innovation does not displace existing compliance obligations. Banks remain responsible for ensuring that their use of AI complies with applicable consumer protection laws, and the OCC has made clear that customer-facing applications, particularly those capable of taking autonomous actions, deserve careful attention.
The challenge for regulators and the industry will be to ensure that supervisory scrutiny does not become an impediment to responsible innovation. This framework represents a constructive effort to strike that balance.