OCC sets first AI guidelines for bank exams

The Office of the Comptroller of the Currency has released its first-ever guidance on how examiners should assess banks’ use of artificial intelligence. Published on November 4, 2026, the framework directs supervisors of large national banks to monitor AI deployments while avoiding treatment of AI as a standalone or unique category of risk. Instead, the technology is to be evaluated within existing risk management frameworks that already govern bank activities.

Under the new approach, banks are not expected to set up separate risk parameters exclusively for AI. The guidance emphasizes that supervision should be proportionate, taking into account the way each lender uses AI as well as the institution’s size and complexity. While the document does not carry the force of a binding rule, it is positioned to shape how examiners conduct reviews of AI-enabled systems across major banks.

The OCC advises examiners to focus primarily on the consequences of potential AI-driven mistakes rather than on how sophisticated a particular model might be. This means supervisors should consider the impact that errors could have on customers, operations, cybersecurity and broader financial stability. The nature of a bank’s AI applications, along with the institution’s overall complexity, is central to determining the level of scrutiny.

The guidance contrasts lower- and higher-risk uses of AI through specific examples. A simple AI agent that is authorized to initiate transactions is highlighted as potentially riskier than a more advanced model that is used solely for internal analytical purposes. The ability to directly trigger financial movements is treated as a key driver of risk, regardless of whether the underlying AI model is technically complex or relatively basic.

Where banks employ AI in higher-risk roles, the OCC indicates that examiners should look for stronger safeguards. These may include tighter limits on the autonomy granted to AI tools and more direct human oversight of their decisions and actions. The expectation is that risk controls scale with the possible consequences of AI failures, with more critical functions requiring more robust governance.

The guidance sits within a broader environment in which banking regulators have been pressing lenders on their AI strategies and controls. Authorities have expressed concern that AI use in finance could create cybersecurity vulnerabilities and potential threats to financial stability if not managed carefully. By clarifying expectations for examiners, the OCC is moving to standardize how AI-related risk is identified and addressed within the US banking system.