OCC Issues First Supervisory Framework for Examining Banks’ AI Use

The US bank regulator says examiners should assess artificial intelligence within existing risk-management frameworks, focusing on how systems are used and the consequences of failure—not simply how advanced the technology is.

The Office of the Comptroller of the Currency (OCC) has issued its first supervisory framework specifically designed to help bank examiners evaluate the use of artificial intelligence in banking.

Published on 4 November 2026, the framework gives examiners guidance for reviewing banks’ use of AI and autonomous, agentic systems in their normal business activities. It also outlines how supervisors should consider the risks and controls associated with those applications.

The OCC’s central message is that AI should not be treated as a separate and distinct risk category. Instead, examiners should assess AI-related risks through existing governance, technology, compliance, operational risk, and model risk practices.

The framework is intended as a supervisory resource. It does not establish new regulatory expectations, enforceable standards, or prescriptive requirements for banks.

OCC focuses on how banks use AI.

The framework marks a shift from evaluating AI primarily as a technology category toward examining its role in a bank’s activities.

The OCC says examiners should tailor their work to the materiality of each use case. That means considering what a system does, the consequences if it fails, and the level of autonomy involved.

The guidance also reflects the range of AI applications now being considered across banking. These include customer service, operations, fraud detection, payments, risk management, and other business activities.

Rather than assuming that every AI application creates the same level of risk, examiners are expected to consider the specific activity and its potential impact.

The OCC said the framework is designed to support assessments of both AI and agentic AI. It also plans to update the guidance as technology, use cases, and supervisory understanding develop.

Consequences matter more than model sophistication.

One of the framework’s key principles is that the potential consequences of an AI system’s failure or misuse may matter more than the technical sophistication of the model.

For example, a relatively simple AI agent that can initiate financial transactions may create greater risk than a more advanced model used for internal analysis.

The difference is the system’s authority and potential impact. An AI tool that can move money, approve actions, or make consequential decisions may require stronger controls than a system that only provides information to employees.

The OCC’s framework indicates that control intensity should increase with the potential consequences of an agent’s failure or misuse. Higher-risk applications may therefore warrant tighter limits on autonomy or more direct human oversight.

This approach places the focus on what an AI system is permitted to do, what could happen if it acts incorrectly, and how the bank can intervene.

Banks do not need a separate AI risk appetite.

The OCC clarified that banks should not be required to establish a separate risk appetite specifically for AI.

Instead, examiners may use AI-specific considerations to supplement existing risk-management practices. These include governance, model risk, technology controls, compliance, and operational risk.

The distinction is significant for banks introducing AI across multiple functions. A separate AI risk framework could create another layer of governance without necessarily improving oversight of the underlying business activity.

The OCC’s approach is to assess AI within the broader risk profile of the institution while allowing examiners to consider the specific features of individual use cases.

The framework also says banks are not expected to use the examiner guide themselves to assess their AI use or AI risk management. It is intended to support supervisory work, not create a new compliance checklist for financial institutions.

Guidance is nonbinding, but supervisory attention is increasing.

The framework does not carry the force of a regulation. The OCC said it does not establish enforceable standards or prescriptive requirements.

However, supervisory guidance can still influence how banks prepare for examinations and document their risk controls. Reuters reported that banks typically pay close attention to such guidance, even when it is not legally binding.

The OCC’s announcement comes amid broader regulatory scrutiny of AI use across the financial system.

US and international authorities have been examining how banks use advanced and agentic AI, including questions about cybersecurity, oversight, monitoring, and potential financial-stability implications.

The new framework gives OCC examiners a more specific resource for evaluating those applications while maintaining a technology-neutral supervisory approach.

Community banks are also within the framework’s scope.

Although the OCC supervises large national banks, its framework may also be used when examining community banks’ AI use.

The regulator says examiners should tailor their approach to each institution’s size, complexity, and risk profile. The assessment should also reflect the nature, consequences, autonomy, and complexity of the bank’s AI use cases.

This proportional approach recognizes that a small institution using AI for internal support may present a different risk profile from a larger bank deploying autonomous systems in customer-facing or transaction-related activities.

The framework therefore does not assume that every bank needs the same level of controls. Instead, it directs examiners to consider the institution and the specific application.

What banks and fintech providers should watch

The framework gives banks and technology providers a clearer indication of how AI-related supervisory discussions may be structured.

For banks, the key questions are likely to concern the purpose of each AI application, its level of autonomy, the consequences of failure, and the controls available to monitor or intervene in its activity.

For fintech providers and vendors supplying AI systems to financial institutions, the framework reinforces the importance of understanding how their products operate within a bank’s broader risk environment.

The OCC has not announced a fixed timetable for future revisions. It says it intends to update the framework as the technology and supervisory understanding mature.

The next development to watch is how examiners apply the framework in practice—and whether future updates clarify specific considerations for emerging AI use cases.

For now, the OCC’s first examiner framework signals a practical direction for bank AI supervision: assess the activity and its consequences, apply proportionate controls, and evaluate AI through existing risk-management systems rather than treating it as a standalone risk category.

Sources: Office of the Comptroller of the Currency, Bulletin 2026-54 and News Release 2026-97, 4 November 2026; Reuters, 4 November 2026.