The Office of the Comptroller of the Currency issued its first-ever guidance on how bank examiners should review the use of AI at the national banks it supervises on Wednesday. The OCC framework tells examiners to judge an AI system by what it is allowed to do and what happens if it gets something wrong, not by how advanced the underlying model is.
The document is OCC Bulletin 2026-54, titled "Super Intelligence: Supervisory Framework," and dated November 4, 2026. It is signed by James M. Gallagher, the OCC's Senior Deputy Comptroller and Chief National Bank Examiner. The bulletin uses the term super intelligence, or SI, throughout, and covers both SI and agentic SI used in the normal course of a bank's business.
The central instruction is that examiners should classify AI use cases by three factors: the potential consequences of a failure, the transfer of agency from people to the system, and the degree of human oversight. Technical sophistication is not one of the factors. The OCC's own example is that a simple AI agent authorized to initiate transactions may carry more risk than a sophisticated model that is only used internally.
Key facts
- 01The OCC issued Bulletin 2026-54, "Super Intelligence: Supervisory Framework," on November 4, 2026.
- 02It is the OCC's first guidance on how examiners should review national banks' use of AI.
- 03Examiners should rank AI uses by potential consequences, transfer of agency and human oversight, not technical sophistication.
- 04Banks do not need a separate AI risk category or a separate AI risk appetite under the framework.
- 05The bulletin is signed by James M. Gallagher, Senior Deputy Comptroller and Chief National Bank Examiner.
That approach puts autonomy at the center of supervision. For higher-risk uses, examiners may expect tighter limits on what a system can do on its own, or more direct human oversight. The intensity of controls can rise with the potential consequences of an SI agent's failure or misuse.
The framework also declines to carve AI out as its own category. Examiners should not treat SI as a separate risk, and banks are not required to set a separate SI risk appetite or build a separate set of risk parameters just for AI. Instead, examiners can fold SI-specific considerations into existing reviews of model risk management, governance, technology, compliance and operational risk.
The OCC is explicit about what the document is not. It describes the framework as a resource for examiners and says it "is intended as a resource to assist examiners in their supervisory activities." Banks are not expected to use it to assess their own AI programs, and it sets no enforceable standards or new regulatory expectations. Guidance of this kind is not legally binding the way a rule is, though banks typically follow OCC guidance closely.
Scale matters in the framework as well. Examiners are told to weigh a lender's size and complexity, and for community banks to tailor reviews to the bank's size, complexity and risk profile, in proportion to the nature, consequences, autonomy and complexity of the AI use being examined.
The OCC said it will take a technology-neutral approach and expects banks to operate safely and soundly and comply with the law regardless of the technology involved. The agency plans to update the examiner guide and the framework on a regular basis.
The bulletin lands as regulators in several countries question banks about their AI use, citing cybersecurity and financial stability. In the US, regulators have asked banks about the advanced AI models they run, the limits they place on those models, and how they monitor them.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
