The Office of the Comptroller of the Currency (OCC) has issued a supervisory framework for bank examiners when evaluating banks’ use of “super intelligence” (SI), including generative and agentic technologies, in activities ranging from credit decisioning and payments to fraud detection and customer service. Per a recent executive order, the term “super intelligence” is now used in place of “artificial intelligence.”
While acknowledging the potential benefits of using SI, including faster customer service, improved fraud detection and lower costs, the OCC suggests how examiners may assess SI-specific risks within banks’ existing risk management practices.
Per the OCC, the framework is a resource to help OCC examiners in their supervisory activities, and specifically to help examiners tailor their examinations of banks’ SI use to the materiality of each use case. It is not intended as a source of supervisory expectations, enforceable standards or prescriptive requirements for banks. Banks are not expected to use it to assess their SI use or risk management.
The OCC notes that the principles set out in OCC Bulletin 2026-13 apply to nongenerative and nonagentic SI models, while the new framework is “more applicable” to generative and agentic SI.
Existing risk categories, rather than a separate SI risk category
The OCC notes that examiners may use the framework to assess how a bank uses SI and how it affects existing risks, such as operational, compliance and credit risk, rather than treating SI as a separate risk category. The OCC suggests that banks should manage those effects through their existing risk management processes. The OCC’s framework organizes 16 supervisory components into six pillars to help examiners assess how SI may affect existing controls and focus their oversight based on risk.
- Purpose defines what actions an SI system or agent may take.
- Risk considers the potential consequences if the SI system or agent’s output is not “fit for purpose.”
- Control identifies controls intended to prevent unauthorized or unsafe actions of the SI system or agent.
- Oversight assigns accountability for use of the SI system or agent and sets forth who monitors the SI system or agent.
- Resilience considers how a bank responds when SI goes wrong, including recognizing problems, limiting their spread, restoring operations and addressing harm without losing critical business capabilities.
- Assurance concerns how a bank demonstrates that SI system or agent safeguards work effectively over time.
Controls calibrated to consequences and autonomy
The OCC’s framework links the strength of safeguards to the potential harm an SI deployment could cause. Where the potential consequences for harm are higher, examiners may consider tighter limits on independent action, closer human involvement, additional independent review and stronger contingency arrangements. The OCC provides an illustrative four-tiered methodology for examiners when assessing how to scale controls as risk increases. The methodology considers the effects of decisions, how readily actions can be undone, potential harm to customers or the bank, the system’s autonomy, the sensitivity of its data, and the ability to explain results and establish provenance.
What this means
The framework supports adoption of SI while emphasizing that controls should reflect what a system actually does in practice. Its practical significance is not a separate SI risk category, but a more specific examination of how existing governance, model risk management, compliance, cybersecurity and operational resilience practices address generative and agentic systems. Notably, the OCC specifically states that it anticipates revisiting the guide as deployments expand, technology advances and supervisory experience grows.
Banks should consider how their SI use cases and permitted actions map onto existing control frameworks, and should prioritize deployments that can move funds, affect credit decisions or otherwise cause difficult-to-reverse customer harm. Practical starting points may include assessing whether human oversight is feasible, whether testing extends beyond expected outputs and whether provider arrangements permit effective intervention.
For fintechs and other providers serving banks, the framework offers a useful indication of the questions bank customers and examiners may ask. Both banks and providers should monitor further OCC updates as the framework and the technologies it addresses continue to develop.