OCC Supervisory Framework Puts Generative and Agentic Bank AI Under Examiner Scrutiny
What happened
On November 4, 2026, the OCC issued a supervisory framework. It helps examiners evaluate AI use at national banks, federal savings associations, and federal branches and agencies of foreign banking organizations. Arnold & Porter's advisory, OCC Issues Supervisory Framework for Bank Use of 'Super Intelligence', explains that the framework is non-binding and does not establish new enforceable standards. It directly addresses a gap in the Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2). The OCC, Federal Reserve, and FDIC issued that guidance in April 2026. It classified generative and agentic AI as outside its scope. The new framework uses the term 'Super Intelligence' (SI) to describe the full range of AI technologies, consistent with Executive Order 14434. It organizes examiner guidance across six pillars: purpose, risk, control, oversight, resilience, and assurance. Examiners are instructed to tailor reviews to each bank's size, complexity, and risk profile, and the OCC describes the document as a living framework it will update regularly.
Why it matters
- ·The framework explicitly covers generative and agentic AI that the April 2026 Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2) left out. Banks that relied on that exclusion to defer governance work now face examiner review of exactly those systems, without having built the required control documentation.
- ·The OCC's consequence-based risk-tiering approach means examiner expectations scale with the impact of an AI failure, not the technical sophistication of the tool. Banks that have not tied their AI risk classifications to business consequences, documented human oversight arrangements, and clear escalation procedures may receive supervisory criticism. This is true even though the framework is not formally binding.
- ·The framework signals that board and senior management accountability for AI risk is a supervisory priority. Although not mandatory, the OCC suggests boards establish a risk appetite for AI, designate accountable executives and use-case owners, and receive regular reports on material AI uses. Banks that cannot demonstrate these structures to examiners face heightened scrutiny.
Stay ahead of stories like this
Get every US AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- Containment failures across AI agents, vendor privacy rollbacks, and deepfake fraud show that unverified trust in AI systems is now a measurable financial liability.12 Nov
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Map every generative and agentic AI system in use to the OCC's six pillars (purpose, risk, control, oversight, resilience, assurance) and identify where documentation is missing or incomplete.
- ☐Confirm that each material AI use case has a documented risk classification based on the consequences of failure, not just the technical type of model, and that the classification is linked to the level of human oversight required.
- ☐Verify that the board or a designated senior management committee receives regular reporting on material AI uses and that accountable executives and use-case owners are formally assigned for each.
- ☐Review third-party and vendor AI arrangements to confirm that privacy, data retention, and cross-border data transfer obligations for AI-generated outputs and prompts are addressed in contracts and internal policies.
- ☐Brief your model risk management team on the gap between the April 2026 interagency guidance and the new OCC framework, so that generative and agentic AI systems previously treated as outside MRM scope are assessed for examiner readiness.
What to watch next
The OCC describes the framework as a living document. It has indicated it will update the framework in response to stakeholder feedback. Compliance teams should monitor OCC communications for revisions that may tighten examiner expectations. The Conference of State Bank Supervisors released a parallel AI supervisory framework for state examiners in September 2026. State-chartered institutions should track whether state regulators align their approach with the OCC's six-pillar model. Congress is also moving toward federal AI legislation, as covered in 2026 Midterm Shift Makes Federal Frontier AI Law Likely by Early 2027. That legislation could create binding requirements that supersede or supplement these examiner frameworks.