OCC Guides Bank Examiners to Assess AI Risk Within Existing Categories

The Office of the Comptroller of the Currency (OCC) issued Bulletin 2026-54 Wednesday, Nov. 4, with an examiner framework directing bank examiners to assess artificial intelligence (AI) within existing risk categories and tailor reviews to each system’s use and potential consequences. It covers routine bank activity from credit decisions and payments to fraud detection, customer service, operations, risk management and market activity.

The framework uses “super intelligence” (SI) for technologies within the existing statutory definition of AI. It places SI within established supervisory categories rather than treating it as its own category. “Examiners should not treat SI as a separate and distinct risk category,” the OCC said in Bulletin 2026-54. Banks do not need to set a separate risk appetite for SI.

The guide is an examiner resource that creates no new supervisory expectations or bank requirements. It is not intended as a self-assessment tool for banks’ SI use or risk management. Examiners may also use the framework for community banks, tailoring reviews to each bank’s size, complexity and risk profile.

The framework contains 16 components grouped into six pillars and an illustrative scale with four risk tiers. A fully autonomous payment agent that interacts with customers is an example of Tier 1. An internal productivity tool with no exposure to customer or financial data is an example of Tier 4; the tiers are illustrative, not required bank classifications.

Risk reviews are guided by a use case’s materiality, its potential consequences, the authority transferred to a system and the degree of human oversight, rather than technical sophistication alone. For uses with greater potential impact, examiners may look for narrower system authority, closer human involvement, added controls, independent testing and operational safeguards. The framework supplements existing model-risk, governance, technology, compliance and operational-risk practices, where SI use can introduce, amplify or modify risks such as operational, compliance and credit risk.

The April 17, 2026, interagency model-risk update excluded generative and agentic AI models. The OCC framework is more applicable to those uses, while the April guidance remains relevant to non-generative, non-agentic models. The OCC plans to update the examiner guide as the technology, its uses and supervisory understanding change.