The Office of the Comptroller of the Currency (OCC) has issued the “OCC Supervisory Framework for Bank Use of Super Intelligence” to guide examiners assessing AI use at U.S. national banks and other institutions it regulates.
The guidance tells examiners to consider what an AI system can do, the consequences if it fails and how much human oversight it receives.
The framework does not introduce new requirements for banks. Instead, it helps examiners assess AI-related risks within existing supervisory practices, with greater attention to systems that can make decisions or take actions without human intervention. The OCC’s accompanying bulletin explicitly says banks are not expected to use the framework to assess their own AI operations.
The guidance follows an April revision to federal banking regulators’ model-risk management guidance, which excluded generative and agentic AI models from its scope.
The OCC’s new framework gives its examiners a separate resource for assessing risks involving those technologies.
The OCC’s use of “super intelligence” follows a September executive order directing federal agencies to adopt the term in place of AI, without changing the technologies covered by the existing statutory definition.
Examiners should assess AI-related risks within existing categories, including operational, credit and compliance risk. Banks are not required to establish a separate AI risk appetite.
Consequences over sophistication
The framework’s central distinction is between a system’s sophistication and the harm it could cause. A simple rules-based agent authorized to initiate transactions could pose greater risk than a sophisticated AI model used only to draft internal documents, it says. The difference lies in the authority granted to the system and the consequences of a mistake.
The OCC illustrates its approach through four risk tiers. Autonomous payment agents, real-time credit decisions and systems that release fraud holds fall into the highest-risk tier. The lowest tier covers fully human-controlled internal productivity tools with no customer or financial data exposure or direct action. The tiers are examples for examiners, not mandatory classifications for banks.
Human oversight and intervention
The OCC distinguishes approval before an AI action from ongoing monitoring with the ability to intervene. The framework says reviewers may need sufficient expertise, information and authority to reject or stop an AI action. Simply requiring someone to approve an output may offer little protection if that person cannot assess it properly. Bulk approvals can further weaken the review process.
For autonomous agents, the framework goes beyond reviewing individual decisions. An agent can continue operating even while taking harmful actions, making it important to consider how failures are detected and contained. For higher-risk uses, the OCC discusses monitoring, intervention and mechanisms to suspend or shut down an agent.
Vendor AI remains the bank’s responsibility
The OCC says responsibility for managing AI-related risks generally remains with the bank, even when outside providers develop, host or operate the technology.
In assessing third-party AI risks, the framework points to vendor notifications, contractual liability and controls over what provider-operated agents can access and do within bank systems. Banks may require notice when suppliers add AI features or change underlying models, while contracts may address responsibility for model-related errors and losses.
The framework also applies to community banks, although the OCC says examiners should adjust their reviews to each institution’s size, complexity and risk profile.