The U.S. Office of the Comptroller of the Currency (OCC) has issued a supervisory framework to help bank examiners assess how financial institutions use AI systems and AI agents, according to a November 4 OCC announcement. 

The OCC published the document, titled Super Intelligence: Supervisory Framework, in Washington. It applies to banks within the OCC’s supervisory jurisdiction, including national banks, federal savings associations and federal branches and agencies of foreign banking organizations.

The framework is intended to help examiners assess banks’ use of super intelligence (SI) or AI and agentic AI in normal-course business activities, along with the associated risks and controls. It supplements existing supervisory considerations around model risk management, AI governance, technology, compliance and operational risk.

The OCC clarified that examiners should not treat AI as a separate risk category, and banks should not be required to define a distinct AI risk appetite. 

Instead, the framework calls for a risk-based assessment of each use case’s nature and materiality, the potential consequences of failure, the transfer of decision-making authority and the extent of human oversight.

The OCC also emphasizes that technical sophistication should not determine risk classification. A relatively simple AI agent authorized to initiate financial transactions, for example, could pose greater risk than a more sophisticated model used only for internal analysis.

Risk Classification Depends on Autonomy and Consequences

The framework directs examiners to consider how much authority an AI system has been given and what could happen if it malfunctions or is misused. Higher-risk applications may warrant tighter controls, restrictions on autonomy or more direct human supervision.

Examiners are also expected to take the size, complexity and risk profile of individual institutions into account, including community banks.

The OCC said it will update the framework regularly as AI evolves and in response to stakeholder feedback. It reiterated that bank activities must be conducted safely and soundly and in compliance with applicable laws, regardless of whether they involve traditional or novel technologies.

Implications for Data and AI Governance

For chief data officers (CDOs), the framework offers a useful example of how AI governance can be linked to the consequences of data-driven decisions and the authority delegated to automated systems.

As AI agents move beyond providing recommendations and begin executing transactions or changing business records, organizations need to establish clear boundaries around the data and systems they can access. Access permissions, audit trails, human approval requirements and escalation procedures become important components of risk management.

The OCC’s approach also reinforces the need for collaboration between data, technology, compliance and risk functions. CDOs can help ensure that information used by AI systems is reliable and traceable, while working with other leaders to establish appropriate controls over automated decisions and actions.

The framework aligns with broader enterprise discussions about AI governance roles and accountability, particularly as organizations introduce increasingly autonomous systems into regulated operations.