OCC issues supervisory Framework on use of AI

On November 4, 2026, the Office of the Comptroller of the Currency (the OCC) issued OCC Bulletin 2026-54 and an accompanying supervisory framework (the Framework) for examiners to use in evaluating banks’ use of artificial intelligence (AI) – pursuant to Executive Order 14434, the OCC now refers to artificial intelligence as “super intelligence”. The Framework is the OCC’s first guidance on how examiners should review banks’ AI use, and it is the first AI-specific examiner framework that any federal banking agency has issued. The Framework covers the AI and agentic AI tools that OCC-regulated banking entities may deploy in their day-to-day operations, such as credit decisioning, payments, fraud detection, customer service, operations, risk management, and market activities.

Structure of the Framework

The Framework groups 16 components into six pillars: (1) purpose, which defines what an AI system or agent may do; (2) risk, which gauges the consequences if the AI system’s or agent’s output or action does not suit that purpose; (3) control, which guards against unauthorized, inappropriate, or unsafe actions; (4) oversight, which assigns monitoring responsibility and accountability; (5) resilience, which addresses a bank’s capacity to detect, contain, recover from, and remediate failures; and (6) assurance, which supplies evidence that controls continue to work effectively.

The Framework also offers an illustrative four-tier methodology under which each use case may be scored on decision consequence, reversibility, customer and financial impact, autonomy, data sensitivity, explainability, and provenance. AI systems and agents that engage in direct action, have low or no reversibility, have high financial or customer impact, and act autonomously or partially autonomously would fall into Tier 1 for “critical” risks. Examples of use cases include autonomous payment agents, real-time credit decisioning, fraud-hold release, and market access. Tier 2 and Tier 3 cover “high” and “moderate” risks, respectively. Those that are not engaged in direct actions, have no customer or financial data exposure and are subject to fully human-controlled use would fall into the Tier 4 category for “low” risks. Examples include internal productivity tools, code assistance, and general employee questions and answers use cases. The Framework contemplates a graduated control model, with lighter-touch controls for low-risk uses and materially heavier controls where AI tools act autonomously, take actions that are difficult to undo, or have high financial or customer impact.

Key compliance and operational considerations

Defined purpose and permitted use. Before deployment and after any material change, OCC-supervised banks should take inventory of each AI system’s or agent’s intended functions and limits, the people and systems authorized to use it, the data and systems it can reach, and the actions it can take. Examiners may view any activity beyond the approved purpose as a control failure, even if the result looks reasonable.

Human oversight. The Framework distinguishes “human-in-the-loop” review, in which a person approves an output or action before the bank relies on it, from “human-on-the-loop” monitoring, in which a person actively supervises the system and has both the authority and the practical means to intervene. The degree and type of human oversight directly impacts the risk that AI use cases are categorized into. The OCC will apply greater scrutiny to the controls in place when AI systems and agents operate with less active human monitoring.

Third-party risk. The bank generally remains accountable for AI risk even when it relies on vendors to develop or host its AI tools. Banks may need to consider evaluating vendor contracts to be provided sufficient notice of changes to the application of AI by vendors and identifying responsibility within respect to AI-related errors.

Customer and financial impact. A recurring theme throughout the Framework is the potential for financial or customer harm as a driver of risk. In classifying the risk of an AI use case, banks should consider the magnitude, breadth, and duration of potential harm to customers, the bank, counterparties, markets, and critical operations, as well as whether an erroneous output or action can be identified and prevented or reversed before any harm occurs. The Framework contemplates that events involving customer harm should be escalated and reported to the board of directors and senior management.

Resilience and compliance. Because an agentic AI system can keep running while making mistakes, banks may need tested tools to contain it, such as circuit breakers, rate limits, least-privilege permissions, and kill switches, as well as a process for remediating harm to affected customers. Using AI does not reduce or eliminate a bank’s existing legal obligations. Areas of heightened risk identified in the Framework include Bank Secrecy Act and sanctions compliance, consumer compliance, and AI hallucinations regarding fees, rates, account status, or policies.

What this looks like in practice

The Framework does not establish new supervisory expectations or enforceable standards and the OCC has noted that the Framework should be viewed as a living document – to be revised periodically as the technology, its applications, and supervisors’ understanding of it develop. Even so, it offers a clear view of how OCC examiners will scope and test AI use and how banks can now use it as a roadmap to inventory and assess their own AI systems and agents ahead of examinations. While the Framework remains cautious, particularly for higher-risk use cases, it signals that regulators may increasingly acknowledge, permit, and even embrace bank use of AI, recognizing that well-controlled AI can improve risk management, reduce costs, and broaden access to financial services.

As a practical matter, banks deploying or planning to deploy generative or agentic AI should consider (1) building or updating a complete inventory of AI use cases; (2) classifying each use case under a consequence-based tiering methodology; (3) mapping existing controls, human oversight, testing, and documentation against the Framework’s 16 components and concentrating enhancements on their highest-consequence use cases; (4) reviewing vendor contracts for AI-specific incident notification, data-use, liability, and change-notice terms; and (5) being prepared to demonstrate that their controls work in practice rather than relying on written policies alone.

Outside counsel can help banks put the Framework into practice by conducting gap assessments of AI governance and controls against the Framework’s components, assisting with AI use-case inventories and risk-tiering, reviewing AI vendor agreements, and evaluating Bank Secrecy Act, sanctions, and consumer compliance implications of specific use cases. Our financial services regulatory team regularly advises banks on these issues and is available to help institutions assess their AI programs in light of the Framework.

Client Alert 2026-210