US Bank Regulator OCC Issues First-Ever AI Guidance Focusing on Risk Over Technical Complexity

OCC Releases Groundbreaking Supervisory Framework for Bank AI Use

The Office of the Comptroller of the Currency issued its first-ever AI guidance for examiners on November 4, 2026, establishing a framework that shifts focus from technical sophistication to real-world consequences1

1

2

2

. The 22-page document provides examiners with tools to evaluate banks' use of artificial intelligence within existing operational, compliance, and cybersecurity risk categories rather than treating AI as a separate risk2

2

. The OCC emphasized that banks are not expected to establish separate risk parameters for AI use and examiners should not treat the technology as a unique risk1

1

.

Consequences Over Complexity in AI Risk Management

The supervisory framework for bank AI use makes a critical distinction between technical capability and potential harm. The OCC said examiners should focus on the consequences of potential AI-driven mistakes at banks rather than the sophistication of particular models they're using1

1

. A simple AI agent authorized to initiate transactions could be considered riskier than a sophisticated model deployed for internal purposes1

1

2

2

. The framework outlines four illustrative risk tiers, with fully autonomous payment agents and real-time credit decision systems falling into the highest category, while basic internal productivity tools occupy the lowest2

2

.

Addressing External AI Agents and Autonomous Systems

The guidance for examiners explicitly addresses outside AI agents operated by customers, fintechs, or other businesses, echoing concerns raised by major banks2

2

. This timing is significant, as the framework arrives less than two weeks after reports that Morgan Stanley was blocking outside agents, while JPMorgan, Bank of America, and Citi were restricting access following discoveries of unauthorized third-party AI agents operating inside customer accounts2

2

. Bank executives described the situation as "horrifying," raising questions about who controls autonomous agents once they have access to someone's money2

2

. The OCC suggests examiners consider measures including identity verification, delegated permissions, transaction limits, monitoring, and the ability to suspend or revoke access2

2

.

Operational Risk and Human Oversight Requirements

Higher-risk uses of AI may require greater restrictions on autonomy or more direct human oversight, the document said1

1

. The framework addresses AI systems that continue operating while making harmful decisions, with suggested safeguards including circuit breakers, rate limits, restricted permissions, and emergency shutdown controls2

2

. Under the framework, examiners can consider the consequences of failure, whether an action can be reversed, and how much control humans retain over the system2

2

. RSA Security CEO Greg Nelson emphasized that as bank employees deploy AI agents, the bank's task is to keep track of the agents, identify those handling higher-risk work and confirm that the right human oversight is in place3

3

.

Non-Binding Guidance Within Existing Risk Management Practices

The bank regulator stressed that the document does not create new regulatory requirements or enforceable standards for banks2

2

3

3

. While the document is not legally binding like a rule, banks typically comply closely with such guidance1

1

. Examiners may use the framework to identify considerations that supplement existing model risk management, governance, technology, compliance and operational-risk practices and to tailor supervisory work to the nature and potential consequences of a bank's use cases3

3

. The OCC said it will adhere to a technology-neutral approach as it encourages safety, soundness and innovation and expects banks to conduct their activities in a safe and sound manner whether they're using traditional methods or novel technologies3

3

.

Global Context and Financial Stability Risks

Banking regulators worldwide have been querying lenders about their AI use, worried the technology poses major cybersecurity and potentially financial stability risks1

1

. In the US, regulators have been asking banks about their use of advanced AI models, what limits banks place on those systems and how they monitor them1

1

. The OCC highlighted AI as both a risk and an opportunity for innovation in its spring 2026 Semiannual Risk Perspective, recommending that banks mitigate AI-enabled cyber risks by implementing more stringent security measures3

3

. Financial services and insurance firms have reached high adoption of AI for 27 of 75 tasks surveyed, with these firms having deeply embedded AI into revenue recognition, credit scoring and sales forecasting3

3

.

Implementation Across Banking Institutions

Examiners must consider the size of each bank, its business activities and the risks it faces during their reviews4

4

. The guidance also applies to smaller community banks, with examiners needing to account for the size of the bank and the complexity of its business1

1

4

4

. The OCC said it intends to update the guidance as the technology develops2

2

. The framework covers AI used in payments, fraud detection, customer service, and other banking operations, extending its risk considerations to external AI agents connecting through bank channels2

2

.