In November 2026, the Office of the Comptroller of the Currency (OCC) issued its Supervisory Framework for Bank Use of Super Intelligence along with OCC Bulletin 2026-54. It is the agency’s most detailed statement yet on how examiners will evaluate banks’ use of generative and agentic artificial intelligence. “Super intelligence” (SI) is the term federal agencies now use for technologies previously called “artificial intelligence” in accordance with Executive Order 14434, 91 Fed. Reg. 63129 (Oct. 2, 2026). The OCC notes that it prepared the framework itself “with the assistance of SI.”
The framework covers SI used in credit decisioning, payments, fraud detection, customer service, operations, risk management, and market activities. It explains that it is “more applicable to generative and agentic SI,” because existing model risk management guidance continues to govern non-generative models. Examiners “should not treat SI as a separate and distinct risk category,” and banks need not define a separate SI risk appetite. Instead, SI risk is to be managed within existing categories, such as operational, compliance, and credit risk.
The framework has 16 components organized under six pillars: purpose, risk, control, oversight, resilience, and assurance. Its central principle is proportionality. The intensity of controls should follow the consequences of an SI system’s failure or misuse, not the system’s technical sophistication. As the OCC puts it, “a simple rules-based agent authorized to initiate transactions could present greater risk than a sophisticated model limited to internal drafting assistance.” An illustrative four-tier methodology scores each use case on several factors, including decision consequence, reversibility, autonomy, and data sensitivity. It also scores explainability: whether an output can be traced to a rationale sufficient for legal obligations such as “adverse action notices.” The OCC’s examples place “real-time credit decisioning” in Tier 1 (Critical). “SI-assisted underwriting” and “agent-initiated customer communications” fall in Tier 2 (High).
On consumer compliance, the framework states that SI “does not change the bank’s underlying legal obligations.” It warns that SI used in customer service, marketing, servicing, collections, or disclosures could create risk if outputs are “materially inaccurate, misleading, or inconsistent with product terms.” It specifically flags hallucinations “concerning fees, rates, account status, or policies.” As safeguards, it suggests limiting automated representations, requiring verification in higher-impact contexts, and supporting prompt correction and remediation. The framework also addresses customer remediation after an SI “misfire.” In that situation, banks may identify the full affected population, assess individual harm, and independently verify completion.
The framework is an examiner resource, not a source of new enforceable requirements. Still, it previews how the OCC may assess SI under existing standards. Banks using SI in underwriting, servicing, or customer communications may want to make sure those use cases are inventoried, tiered, and documented in a way that can explain adverse action reasons. Banks may also want controls that catch SI misstatements about fees, rates, or account terms. The OCC treats inaccurate SI outputs as a consumer compliance issue, and such errors may increase exposure to UDAAP claims and related litigation.