OCC sets examination focus for banks’ AI use

The Office of the Comptroller of the Currency issued a supervisory framework on November 4, 2026, to help examiners evaluate banks’ use of generative and agentic AI. The framework does not create regulatory requirements, enforceable standards or a separate risk category. Instead, it directs examiners to assess how these technologies affect existing operational, compliance, model, cybersecurity and third-party risks, with scrutiny proportionate to each bank’s size, complexity and applications.

The framework organizes assessments around purpose, risk, control, oversight, resilience and assurance. It highlights testing for hallucinations, adversarial inputs and changing model behavior, alongside safeguards such as restricted permissions, circuit breakers and fallback procedures. Human oversight must be substantive: reviewers need the expertise, authority and capacity to reject, modify or halt actions. Control intensity should reflect a system’s autonomy, potential consequences and reversibility.

Customer-facing applications receive particular attention because inaccurate statements about fees, interest rates or account status can cause harm and create legal liability. Banks remain responsible for compliance when AI generates an improper statement or action. Vendor oversight should address access to customer data, visibility into agents’ activities, responsibility for errors and notice of material changes. An illustrative risk-tiering methodology is not mandatory, and banks are not expected to use the framework to assess their programs. The OCC plans regular updates and invites stakeholder feedback.