OCC Framework Offers Insight into Examiners’ Approach to Super Intelligence Risk

Issued: November 6, 2026

What is new?

On November 4, 2026, the Office of the Comptroller of the Currency (OCC) issued a supervisory framework to help examiners evaluate banks’ use of super intelligence (SI), including generative and agentic technologies. The framework provides insight into how examiners may consider these technologies within banks’ existing risk management and control practices.

The accompanying bulletin makes clear that the framework creates no new regulatory expectations or enforceable standards, and banks are not expected to assess themselves against it. The bulletin uses SI to refer to technologies previously encompassed by the term artificial intelligence (AI).

The Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC) have also recently taken steps to address these emerging technologies.

What does the framework signal for examinations?

The framework helps banks and their counsel anticipate the issues examiners may raise. Its central principle is proportionality: the rigor of controls should reflect the potential consequences of failure or misuse, the system’s authority to act, and the degree of human oversight. An agent authorized to initiate payments, for example, may warrant stronger controls than a tool limited to internal drafting. The framework also addresses governance, testing, third-party risk, ongoing monitoring, and documentation.

The framework supplements existing model risk management, governance, technology, compliance, and operational risk practices. Examiners should not treat SI as a separate risk category, and banks are not required to establish a separate SI risk appetite. SI can introduce, amplify, or change risks within existing categories, including operational, compliance, and credit risk. Banks should identify, measure, monitor, and control those risks through their existing risk management frameworks.

Banks and their counsel should read the framework alongside OCC Bulletin 2026-13, “Model Risk Management: Revised Guidance,” while recognizing the documents’ different scopes. That guidance addresses model development, use, validation, monitoring, and governance but expressly excludes generative and agentic AI models.

Examinations should reflect each bank’s size, complexity, and risk profile. The potential consequences of failure, the system’s authority to act, and the degree of human oversight should inform the intensity of controls.

The OCC also describes the framework as a living document that it intends to update regularly as technology, use cases, and supervisory understanding evolve. Banks and their counsel should therefore monitor revisions and consider their implications for ongoing operations and examination preparation.

What does the framework cover?

The framework addresses sixteen control areas. The following summaries highlight practical considerations, not new regulatory requirements:

1. Defined Purpose and Permitted Use. Specify authorized activities and boundaries.
2. Risk Classification and Criticality Assessment. Assess consequences, autonomy, and reversibility.
3. Human-in-the-Loop and Human-on-the-Loop Controls. Establish effective approval processes before execution or ongoing monitoring with authority to intervene.
4. Governance & Accountability. Assign owners, decision rights, and oversight responsibilities.
5. Model Risk Management Extensions. Adapt validation to changing and variable outputs.
6. Data Governance. Assess data quality, origins, access, and permitted uses.
7. Privacy. Address sensitive information, retention, and vendor data use.
8. Compliance. Evaluate SI’s effects on applicable legal obligations.
9. Third-Party & Vendor Risk. Review vendor authority, incident notification, and contractual responsibility. New vendor features or model changes may warrant reassessment or retesting.
10. Operational Resilience. Plan for containment, recovery, and continued operations.
11. Cybersecurity. Address threats to prompts, models, data, and connected tools.
12. Performance Monitoring. Track production behavior and escalate material deterioration.
13. Testing. Evaluate performance and controls throughout development and use, including under adverse conditions.
14. Documentation & Auditability. Preserve records supporting reconstruction of decisions and changes.
15. Internal Audit & Independent Challenge. Maintain independent assessments of controls by qualified reviewers.
16. Reporting & Transparency. Give management timely information about use, incidents, and remediation.

Other regulators’ priorities and initiatives

The SEC Division of Examinations’ Fiscal Year 2027 Examination Priorities provide additional context. The division will prioritize examinations of “policies and procedures relating to monitoring SI,” including its use in fraud prevention and detection, back-office operations, anti-money laundering compliance, Regulation Best Interest obligations, and trading. It also highlights registrants’ “assessment and preparation for potential threats from SI-related cyberattacks,” including phishing and deepfake social engineering.

Although directed at SEC registrants, these priorities show that regulators are focused both on firms’ own use of SI and on threats arising from its use by others. The CFTC’s Innovation Task Force is also engaging on the issue and recently released the agenda for the inaugural Frontier Forum on Super Intelligence.

Taken together, these developments signal that regulators are moving quickly to understand how the industry uses SI and the risks it poses.

What should banks consider?

Banks and their counsel should actively monitor regulatory developments and consider whether risk management practices remain appropriate as technology and use cases evolve. Practical steps include:

• Maintain visibility into use. Identify internally developed and vendor-provided capabilities, permitted activities, access, and accountable owners.
• Monitor performance and changes. Review errors, exceptions, overrides, and changes to models, data, permissions, and vendor functionality. Establish thresholds for escalation and intervention, and determine when to evaluate associated risks.
• Test controls and document results. Evaluate whether human oversight, access restrictions, and response procedures work in practice. Retain evidence supporting material decisions, changes, and remediation.

How BRG can assist

BRG’s Financial Institution Advisory practice works with financial institutions and their counsel to assess regulatory developments and address operational and compliance risks. Support can include gap analysis, use-case inventories, and risk assessments; governance, policy, and control reviews; monitoring and testing programs; third-party risk assessments; and examination preparation and remediation. BRG helps clients identify gaps, prioritize actions, and document their approach based on their activities and risk profiles.

For more information, please contact Paul Noring (pnoring@thinkbrg.com), Barbara Vanich (bvanich@thinkbrg.com), or Michael Sullivan (Sullivan.Michael@thinkbrg.com).

This alert addresses the supervisory framework as of November 6, 2026. It is for general information and is not a substitute for advice on your specific circumstances.