The Office of the Comptroller of the Currency (OCC) released a new supervisory framework on November 4 to assist examiners in reviewing how banks utilize artificial intelligence. The guide specifically addresses generative and agentic AI, referred to as super intelligence in accordance with a September 29 executive order.
According to an analysis by Ballard Spahr, the document does not establish new regulations or require banks to categorize AI as a distinct risk. Instead, examiners will evaluate how AI impacts existing risk areas, such as cybersecurity, fraud, privacy, and vendor management. The framework outlines six key areas for assessment, including system autonomy, guardrails, and recovery protocols.
The OCC defined four risk levels based on the autonomy of the AI systems. High-risk activities include autonomous payment bots and instant credit decisioning, while internal tools that do not process customer data are considered low-risk. The framework emphasizes that the level of control must correspond to the consequences and autonomy of the AI activity.
The guidance stresses that human oversight must be substantive, requiring reviewers to possess the necessary skills and authority to override AI actions. Banks remain legally responsible for AI errors, including those involving chatbots that provide inaccurate information to customers. Furthermore, the OCC mandates increased scrutiny of third-party vendors, particularly regarding contractual liability and notification of AI updates.
While the OCC stated that the guide sets no binding standards and banks are not required to use it for self-assessment, the analysis suggests that financial institutions should review their compliance programs against these criteria. Understanding the examiner's perspective may help banks identify and address potential gaps before future inspections.
