OCC tells bank examiners: don't treat AI as its own risk category

The US bank regulator's first AI-specific framework skips new rules, instead telling examiners to check if AI tools amplify risks banks already manage.

What happened: On November 4, 2026, the Office of the Comptroller of the Currency, which supervises national banks, issued its first-ever supervisory framework covering how examiners should look at banks' use of artificial intelligence. The document, officially titled a framework on bank use of "Super Intelligence" (the executive branch's new term for AI following a September 29 Trump order), applies to big national banks like Bank of America and Citigroup. It is guidance for examiners, not a new rulebook for banks.

Why it matters: Banks are rapidly rolling out AI, including agents that can act on a customer's behalf to move money or process transactions. Until now there was no dedicated OCC playbook for how examiners should evaluate that shift. This framework sets the tone: regulators will fold AI oversight into existing supervision rather than inventing a parallel AI compliance regime, which shapes how aggressively banks are pushed to manage AI-specific dangers going forward.

How it works, plainly: The OCC says examiners should not treat AI as a separate, distinct risk category, and banks do not have to write a standalone "AI risk appetite" statement. Instead, examiners use the framework to spot ways AI could intensify risks banks already manage, like credit, operational, compliance or cyber risk, and fold that check into existing reviews of model risk management, governance and technology controls. The approach is meant to be technology-neutral: same safety-and-soundness bar whether a bank uses an AI agent or a traditional process.

The rollout: This follows the OCC's spring 2026 risk report, which had already flagged AI-enabled cyber threats alongside AI's innovation upside, urging banks to tighten security. Adoption is already deep: industry survey data cited by PYMNTS found banks and insurers have reached high AI use across 27 of 75 surveyed tasks, especially credit scoring, revenue recognition and sales forecasting. One security executive noted banks increasingly need tools just to inventory which AI agents they're running and which ones carry higher risk.