On November 4, the OCC issued a framework to help examiners evaluate banks’ use AI or what it refers to as “super intelligence”, including agentic AI, in ordinary business activities. The framework supplements the OCC’s announcement, which describes the agency’s technology-neutral approach to bank supervision.
The framework is an examiner resource, not a set of new supervisory expectations or enforceable standards. The OCC says banks are not expected to use it to assess their own AI use or risk management. Examiners may use it to tailor reviews to the materiality and potential consequences of particular use cases. Specifically, the framework:
- Applies existing risk practices to AI.Examiners may consider AI-specific issues alongside banks’ existing model risk management, governance, technology, compliance, and operational-risk practices. The OCC says AI should not be treated as a separate risk category, and banks should not be required to establish a separate AI I risk appetite.
- Focuses risk assessments on use and consequences. A bank’s classification of an AI use case may account for its potential consequences, the degree of agency transferred to the system, and the level of human oversight, rather than the technology’s sophistication alone.
- Scales review and controls to the use case. The intensity of controls may increase with the potential consequences of an AI agent’s failure or misuse. For community banks, examiners should consider the bank’s size, complexity, and risk profile, as well as the nature and autonomy of its AI use.
Putting It Into Practice: The OCC is signaling that examiners may assess AI through banks’ existing risk disciplines, with attention tailored to each use case. The approach adds a bank-supervision dimension to broader federal attention to AI deployment, including the firm’s earlier discussion of federal AI integration efforts (previously discussed here). Banks should inventory AI and agentic AI uses, consider their consequences and human oversight, and ensure existing controls remain appropriate as deployments evolve. Banks should continue to monitor OCC updates and assess their risk-management practices as the technology and supervisory approach develop.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
