The Office of the Comptroller of the Currency has issued a supervisory framework for banks using “super intelligence.” It gives examiners a way to assess AI-related risks, including consumer harm and human oversight, without creating a new enforceable AI rule.
The Office of the Comptroller of the Currency (OCC) issued a supervisory framework on November 4, 2026, to help examiners evaluate banks' use of “super intelligence” in ordinary business activities.
The framework covers credit decisions, payments, fraud detection, customer service, operations and market activity. It places particular emphasis on the consequences of automated decisions, the effectiveness of human oversight and potential harm to consumers.
Despite its broad scope, OCC Bulletin 2026-54 is an examiner resource, not a new binding AI regulation.
What the bulletin changes
The OCC bulletin explicitly states that the framework does not establish supervisory expectations, enforceable standards or prescriptive requirements for banks.
Banks are not expected to adopt the document as their own AI risk-assessment framework.
Instead, the OCC instructs examiners to tailor their assessments to the materiality and potential consequences of each use case, taking account of a bank's size, complexity and risk profile.
The regulator also says examiners should not treat super intelligence as a separate risk category. Banks do not need a distinct super-intelligence risk appetite.
Under the framework, control intensity could increase with the consequences of an automated decision, the transfer of agency to a system and the degree of human oversight.
Technical sophistication alone does not determine the appropriate scrutiny.
A relatively simple system authorized to move money may therefore present greater risk than a sophisticated model limited to drafting internal documents.
Consumer harm becomes an explicit examination consideration
The framework identifies consumer-facing AI as a potential source of compliance and legal risk.
Systems used for customer service, loan servicing, collections, marketing or disclosures could generate statements that are materially inaccurate, misleading or inconsistent with product terms.
The OCC specifically identifies hallucinations concerning fees, interest rates, account status and bank policies as potential sources of consumer harm.
Its framework describes possible controls that limit automated representations, require verification in higher-impact situations and support prompt correction or remediation.
Those measures are illustrative considerations, not newly mandated procedures.
The practical implication is that examiners may look beyond whether an AI model performs accurately in testing.
They may also consider whether a bank can reconstruct a customer-facing statement, determine how it was verified, identify who can correct an error and assess whether affected customers received appropriate remediation.
This connects AI governance to operational evidence and consumer outcomes rather than treating model performance as an isolated technical issue.
Human oversight depends on actual authority
The framework distinguishes between human-in-the-loop controls, where a person approves an action before execution, and human-on-the-loop controls, where a person monitors a system and can intervene.
For consequential use cases, the relevant question is whether human oversight is effective.
A nominal reviewer may offer little protection if that person lacks sufficient information, expertise, time or authority to challenge an automated decision.
The OCC's framework identifies reviewer competence, practical intervention rights and meaningful approval processes as considerations for examiners.
This does not impose a universal requirement for manual approval of AI decisions. The appropriate level of oversight depends on the risks and consequences of the use case.
Six pillars organize the examination framework
The OCC supervisory framework PDF groups 16 components into six pillars: purpose, risk, control, oversight, resilience and assurance.
Examiners may consider several factors when evaluating an AI system, including decision consequences, reversibility, customer and financial impact, autonomy, data sensitivity, explainability, provenance and permission scope.
Together, these factors support a graduated approach.
A model that drafts an internal summary may warrant lighter controls than one that changes a credit decision, communicates an account balance or initiates a transaction.
The framework also addresses operational resilience. An autonomous system could remain technically available while taking inappropriate actions, making detection, containment and recovery important considerations.
The OCC presents these measures as examples for risk-based supervisory judgment, rather than a uniform control checklist.
Banks remain accountable for third-party AI
The framework extends its examination considerations to outside technology providers.
Banks frequently obtain AI capabilities from vendors rather than developing them internally. That reliance can introduce model, operational, data, legal and resilience risks.
The OCC says banks should consider how vendor contracts allocate responsibility for model-related errors and losses, including customer harm.
Such assessments may address indemnification, liability caps and responsibility for losses.
The framework also identifies possible arrangements for incident notification, provider permissions and notice when vendors introduce new AI features or change underlying models.
These are not newly prescribed contractual terms.
However, the framework reinforces an existing supervisory principle: relying on an outside provider does not generally transfer responsibility for managing the bank's risks away from the bank.
Existing legal obligations remain in place
The new guidance does not create an AI-specific filing requirement or a separate enforceable compliance regime.
Banks remain responsible for managing their existing governance, compliance, operational resilience and third-party risks under applicable legal and supervisory requirements.
Examiners may assess evidence that relevant controls operate effectively, but the new framework itself does not impose additional documentation obligations.
The distinction matters legally.
Under the OCC's supervisory guidance policy, guidance does not have the force of law, and failure to follow guidance alone is not a basis for enforcement or supervisory criticism.
Regulators can still act when underlying conduct violates applicable law or constitutes an unsafe or unsound banking practice.
The OCC's April 17, 2026 model-risk guidance establishes principles for traditional statistical and quantitative models, including non-generative and non-agentic AI.
Generative and agentic AI models are expressly outside that guidance's scope.
The November framework provides examiners with a supplemental reference for evaluating those technologies, without converting its illustrative considerations into binding requirements.
What will determine its impact
The OCC has said it intends to update the framework as AI technologies, banking applications and supervisory understanding develop.
Its practical influence will depend on how examiners apply the concepts to actual bank operations.
Over time, examination findings, remediation requests and any subsequent framework revisions may reveal whether its risk-based considerations become widely used reference points in supervisory practice.
That remains an inference, not an established regulatory outcome.
For banks, the immediate distinction is clear: the OCC has introduced a more detailed way for examiners to consider AI-related risks, particularly those affecting customers, but has not created a new AI compliance rule.
The consequential question is whether existing controls can address the real-world effects of increasingly autonomous banking systems.