OCC releases supervisory framework for bank use of Super Intelligence

The OCC announced a supervisory framework that examiners can use to evaluate banks’ deployment of artificial intelligence and agentic AI in routine operations.¹² The guidance is not a set of enforceable standards or prescriptive requirements for banks.¹ It also does not create a separate risk category for Super Intelligence, nor does it require banks to define a distinct SI risk appetite.¹ That distinction matters because the framework gives examiners a way to assess the use of these technologies without establishing a new category of binding rules for banks.¹ Banks therefore face examination of AI and agentic AI use in normal business activities, but the framework itself does not prescribe a separate SI risk appetite or enforceable standard.¹

Instead, the OCC will apply a technology‑neutral approach that encourages safety, soundness and innovation regardless of the underlying method.¹ Examiners are expected to treat activities that use traditional tools and those that employ novel AI technologies alike, consistent with applicable laws and regulations.² This approach places the focus on how banking activities are conducted, rather than whether a bank relies on traditional methods or emerging technology.¹² For banks, the stated aim is to pursue innovation while keeping activities safe and sound and in line with applicable laws and regulations.¹² The framework’s technology neutrality also means that novel AI applications are not singled out as exempt from the standards that apply to other banking activities.¹²

The framework allows examiners to identify Super Intelligence‑specific considerations that complement existing model risk management, governance, technology, compliance and operational‑risk practices.¹ These considerations are intended to supplement, not replace, the banks’ current risk controls.¹ That structure connects SI review to the risk management areas banks already use, rather than describing it as a replacement for those practices.¹ The areas named in the framework span model risk management, governance, technology, compliance and operational risk, giving examiners several existing practices to consider when assessing SI use.¹ Banks’ existing practices remain relevant in this approach, while examiners may add considerations specific to Super Intelligence where appropriate.¹

The OCC previously highlighted AI as both a risk and an opportunity in its spring 2026 Semiannual Risk Perspective.¹ In that earlier communication, the agency recommended that banks strengthen security measures to mitigate AI‑enabled cyber risks.¹ The OCC’s earlier framing paired potential risks with potential opportunities, rather than presenting AI solely as a threat.¹ Its recommendation on more stringent security measures identifies cyber risk as a practical concern for banks using AI-enabled activity.¹ Together, those points show that the agency’s discussion of AI includes both the possible benefits and the security measures it says banks should take to reduce cyber risks.¹

The new framework reflects the agency’s view that Super Intelligence and agentic Super Intelligence are novel, rapidly evolving technologies that banks are already deploying across new use cases.² By framing the guidance as technology‑neutral, the OCC signals that the same supervisory expectations apply whether a bank uses legacy systems or cutting‑edge AI.¹ The rapid evolution described by the OCC means the technologies and the ways banks deploy them across use cases are continuing to change.² That context helps explain why the framework is aimed at examiners assessing bank activities, rather than limiting its attention to a fixed set of AI applications.¹² Traditional systems and novel AI applications remain within the same technology-neutral approach, even as banks continue deploying SI and agentic SI across new use cases.¹²

The OCC indicated that the framework will be updated regularly to incorporate evolutions in Super Intelligence and feedback from stakeholders.² Regular revisions are intended to keep the guidance aligned with the fast‑moving AI landscape.² The update plan acknowledges two sources of change: developments in SI and views shared by stakeholders.² For banks and examiners, regular updates mean the framework is not presented as a document that will remain unchanged as the technology evolves.² The OCC’s stated plan links future revisions to both technological evolution and stakeholder feedback, without specifying a fixed schedule or particular changes.²

Banks are therefore not required to create a separate risk appetite for Super Intelligence, simplifying their overall risk management structures.¹ Instead, they can integrate SI considerations into existing risk frameworks as directed by examiners.¹ This means banks do not have to define a distinct SI risk appetite under the framework, while examiners may still consider SI-specific issues alongside established practices.¹ The distinction is between creating a separate risk category and using existing risk management areas to address relevant SI considerations.¹ For banks, the OCC’s stated approach keeps the existing practices in view without requiring a separate SI risk appetite.¹

The OCC’s press release on November 4, 2026, emphasized that the framework is part of a broader effort to ensure safe and sound banking practices while fostering innovation.² The agency’s stance underscores a balance between regulatory oversight and the encouragement of technological advancement.¹ The announcement date identifies when the OCC said it had issued the framework, while its stated principles concern both safe and sound activity and innovation.¹² Those principles apply to bank activities whether they rely on traditional methods or novel technologies, according to the OCC’s technology-neutral approach.¹² The framework thus places innovation alongside safety and soundness, rather than describing those aims as alternatives.¹²

Overall, the supervisory framework provides a structured yet flexible tool for examiners to assess AI use without imposing new regulatory burdens, aligning with the OCC’s long‑term vision for responsible innovation in the banking sector.¹ Its practical role is to help examiners evaluate AI and agentic AI in normal bank activities and identify considerations that supplement existing risk practices.¹ The framework’s limits are also clear: it does not establish enforceable standards or prescriptive requirements, and it does not require a separate SI risk appetite.¹ At the same time, technology neutrality does not remove the OCC’s stated expectation that bank activities remain safe and sound and consistent with applicable laws and regulations.¹² The result is guidance for examination that brings SI-specific considerations into existing practices while keeping traditional and novel technologies within the same general approach.¹