How the OCC wants examiners to judge bank AI by consequence, autonomy and oversight

A bank that lets a simple software agent send money can draw more examiner attention than one that runs a cutting-edge model that only drafts internal memos. That is the practical core of the Office of the Comptroller of the Currency’s Wednesday, Nov. 4, supervisory framework for what the agency calls super intelligence, or SI.

The OCC published the framework with Bulletin 2026-54, titled “Super Intelligence: Supervisory Framework,” and News Release 2026-97. The full examiner guide walks through how examiners may classify use cases, judge human oversight and map SI into existing bank risk categories. Reuters described the issuance as the OCC’s first-ever guidance for how examiners should probe banks’ AI use.

Consequence, agency and oversight, not sophistication

The framework’s overarching principle is that control intensity can rise with the potential consequences of an SI agent’s failure or misuse. “Risk classification may be based on potential consequences, transfer of agency, and the degree of human oversight, rather than the technical sophistication of the SI used,” the guide says.

In plain terms, examiners are told to ask what the system can do to customers, markets or the bank if it is wrong; how much decision-making or action authority has been handed to the system; and how strong the human checkpoint is. Model size, architecture novelty or benchmark scores are not the primary ranking factors in that formulation.

The OCC’s own example drives the point: “a simple rules-based agent authorized to initiate transactions could present greater risk than a sophisticated model limited to internal drafting assistance.”

An illustrative tiering table in the guide puts a fully autonomous, customer-facing payment agent in Tier 1 (Critical) “regardless of how well it performs in testing,” while a simple internal productivity tool with no customer or financial data exposure sits at Tier 4.

Human-in-the-loop, human-on-the-loop and no loop

The guide defines two oversight models examiners should look for.

Human-in-the-loop, or HITL, “generally refers to review and approval before an output or action is used or executed.” In the glossary, HITL is a risk-control approach “where a human is integrated within the SI’s decision-making process.”

Human-on-the-loop, or HOTL, “generally refers to active monitoring with authority and practical ability to intervene.” The glossary describes HOTL as an oversight model in which an SI agent or system “is operating independently and a qualified human is overseeing, overriding and/or halting actions based on predefined parameters.”

The guide’s autonomy scale also includes a fully autonomous posture: the system “acts without real-time human checkpoint.” That is the no-loop end of the spectrum for exam purposes. Higher-consequence uses “may warrant greater restrictions on autonomy, stronger controls, more direct human oversight, more independent validation, and more robust resilience measures,” the framework says.

Examiners are also steered to ask whether the named reviewer has enough expertise and authority to “evaluate, reject, modify, pause, or halt” an action, and whether review is meaningful rather than a nominal click under high volume.

SI is not a separate risk appetite requirement

Bulletin 2026-54 and the news release both stress that SI is not a standalone risk silo. Examiners “should not treat SI as a separate and distinct risk category, and banks are not required to define a separate SI risk appetite,” the OCC said. SI use “can introduce, amplify or modify risk in existing risk categories, such as operational, compliance and credit.”

That wording matters. Banks are not told they must invent a new “SI risk appetite” bucket. Elsewhere, the guide notes that boards and senior management “may establish an SI risk appetite” as part of governance, including autonomy and permitted actions. The required reading for examiners is still that SI flows through the bank’s existing risk management framework, not that SI becomes a new free-standing risk type.

Guidance for examiners, not a binding rule

The bulletin says the framework “does not establish supervisory expectations for banks” and is “intended as a resource to assist examiners in their supervisory activities.” Banks “are not expected to use this document to assess their use of SI,” and nothing in it is intended to set “new regulatory expectations or set forth enforceable standards or prescriptive requirements,” the OCC wrote.

Reuters noted that such guidance is not legally binding like a rule, though banks typically comply closely with examiner guidance. The OCC said it intends to update the framework as technology and use cases change.

What “super intelligence” means here

The OCC’s SI label is a terminology shift, not a claim that every bank model is an artificial general intelligence. Bulletin 2026-54 defines SI as the technologies previously encompassed by “Artificial Intelligence” under 15 U.S.C. 9401(3), “as well as the promise, potential, and rapidly advancing capabilities of those technologies,” citing Executive Order 14434, 91 Fed. Reg. 63129 (Oct. 2, 2026).

In short, the bulletin tells examiners to treat generative and agentic systems under the same safety-and-soundness lens as other bank technology, while weighting what the system can do, how independently it can act and how humans can stop it.

Story so far

OCC issues what Reuters calls its first-ever AI guidance for bank examiners (November 4, 2026)