On November 4, the Office of the Comptroller of the Currency (OCC) released Bulletin 2026-54, a supervisory framework to assist examiners in their evaluation of banks’ use of super AI and agentic systems (referred to by the OCC as “superintelligence”) used in the normal course of business activities, including everything from credit decisioning to fraud detection. The framework treats AI as introducing, amplifying, or modifying risk in existing risk categories, rather than as a separate risk category. That characterization is consistent with the OCC’s previous perspective, which warned that lack of investment in new technologies, products, and services “may present material risks to long-term bank performance.” The OCC views ”standing still” as not a risk-free stance; rather, banks must innovate and adapt to the changing landscape. Nonetheless, innovation must be well governed.
What the Framework Does & Does Not Do
The framework groups 16 components into six pillars and adds an illustrative control risk tiering methodology and a technical dictionary. The OCC stresses that it sets no new supervisory expectations or enforceable standards and that the framework is not intended for bank self-assessment. Instead, it serves as an examiner resource as they are instructed to tailor their work to the materiality of each use case and to a bank’s size, complexity, and risk profile. Nevertheless, the framework is an important tool for banks to understand how AI may be examined.
The framework also fills an important gap. The April interagency model risk guidance (OCC Bulletin 2026-13) places generative and agentic AI outside its scope; as such, the framework is the more applicable resource for those AI uses. The agencies still plan to seek input on model risk management that considers generative and agentic AI, which could shift that boundary. However, the framework will likely remain highly relevant, at least for the foreseeable future. The framework covers OCC-supervised institutions, so state-chartered banks should also watch Federal Reserve and FDIC positions.
Consequence, Not Sophistication
The framework emphasizes that control intensity could increase with the potential consequences of an AI agent’s failure or misuse. For example, a simple rules-based agent authorized to initiate transactions can present more risk than a sophisticated model used only for internal drafting. The illustrative tiers (shown below) make this concrete: autonomous payment agents, real-time credit decisioning, fraud-hold release, and market access rank as Tier 1 (Critical), while internal productivity tools with no direct action and fully human-controlled use rank as Tier 4 (Low).
Illustrative Risk Tier Definitions
| Illustrative Composite Tier | Illustrative Profile Characteristics | Illustrative Use Case |
|---|---|---|
| Tier 1: Critical | Direct action, low/no reversibility, high financial or customer impact, autonomous or partially autonomous | Autonomous payment agent; real-time credit decisioning; fraud-hold release; market access |
| Tier 2: High | Direct action or high-weight decision support, human-on-the-loop, moderate-to-high impact | SI-assisted underwriting; agent-initiated customer communications; AML alert disposition; code assistance for internal code or data access changes |
| Tier 3: Moderate | Decision support with mandatory human-in-the-loop, limited data sensitivity, reversible | Internal document summarization for credit memos; agent-assisted research |
| Tier 4: Low | No customer/financial data exposure, no direct action, fully human-controlled use | Internal productivity tools; code assistance; general employee Q&A |
Source: occ.gov
Though not a self-assessment tool, the framework lays out a series of “pillars” that offer a useful lens to assess readiness.
| Pillar | What Examiners May Look For | Question to Ask Internally |
|---|---|---|
| Purpose | Documented permitted actions, data, systems | Can we test what each agent is allowed to do? |
| Risk | Consequence-based classification | Which use cases act rather than advise? |
| Control | Human oversight, model risk, data, privacy, compliance, cyber | Can reviewers actually override or halt? |
| Oversight | Accountable owners, monitoring, reporting | Who answers if it fails? |
| Resilience | Detection, containment, recovery | Can we stop an agent that is running but wrong? |
| Assurance | Testing, documentation, vendor risk, audit | Can we reconstruct a material decision? |
Source: Analysis by Forvis Mazars of the OCC Supervisory Framework on Bank Use of Super Intelligence, November 2026.
Where to Focus Preparation
The framework does not rank its components, so these priorities reflect our understanding, not an OCC ranking. Priorities may vary based on unique bank/firm scenarios and may shift as this framework is developed.
- Inventory and purpose. Activity outside an approved purpose may be treated as a control failure even when the output appears reasonable. Confirm the AI inventory is current, including features embedded by existing vendors.
- Human oversight. Review should be more than a click; bulk approvals and alert fatigue erode its value. Test whether a review of high-consequence uses is substantive.
- Resilience. An agent can stay available while taking harmful actions. Confirm kill switches, tested fallbacks, and a customer remediation process.
- Third parties. Accountability generally remains with the bank. Review contracts for change notice, incident notification, data use, and liability.
- Independent assurance. Confirm internal audit can reach underlying evidence, and that board reporting reconciles to the inventory and incidents.
Our Take
The framework will likely shape examination conversations, and the absence of a separate risk category does not mean lighter scrutiny. Examiners will likely look for evidence that banks identify, measure, and control AI’s contribution to existing risks.
Classification turns on consequences, not technical sophistication. Because examiners scope by materiality, we expect attention to concentrate on the highest-consequence, most autonomous use cases. A simple rules-based agent authorized to initiate transactions can present more risk than a sophisticated model used only for internal drafting. Governance focused only on advanced models may leave risk misaligned. Clear ownership, defined permitted uses, and meaningful human checkpoints are a sensible starting point.
How Forvis Mazars Can Help
Whether you are piloting your first use case or scaling AI across the enterprise, our Financial Services Risk & Regulatory Consulting professionals can help you innovate with confidence and be ready for examiner conversations. Our services include:
- AI risk assessment and use case tiering: Classify use cases by consequence, autonomy, and level of human oversight.
- Governance and policy development: Define accountable owners, approval authority, risk appetite, and board and management reporting.
- AI inventory and documentation: Build a current, auditable inventory of purpose, permissions, owners, and vendors.
- Model risk management and control testing: Design and test controls, including human oversight, containment, and fallback processes.
- Third-party risk management: Strengthen vendor oversight, contract provisions, and change-notification practices.
- Regulatory and compliance mapping: Align AI practices with existing model risk, compliance, privacy, and cyber expectations.
- Ongoing compliance monitoring and testing: Independently assess AI-enabled processes and outcomes for adherence to applicable laws and regulations, including whether human oversight and escalation controls are operating effectively.
- AI incident response and remediation: Assess the regulatory and customer impact of AI-related failures, identify affected populations, support corrective action, and independently validate that remediation is complete and sustainable.
- Internal audit and independent challenge: Provide independent testing and assurance over AI governance, controls, regulatory compliance, and the effectiveness of ongoing monitoring.
Contact our team to discuss how we can support your AI governance and exam readiness.