Large office building at a street corner: two tan piers flank a recessed dark-glass section between glass-walled wings under a clear blue sky, with trees along the sidewalk and a white pickup truck on the street.
Constitution Center in Washington, DC, June 21, 2024. The OCC lists this building as its headquarters. Archive photograph; it does not depict the November 2026 framework, an examination, or any bank. ajay_suresh / Wikimedia Commons · CC BY 2.0

An Examiner Resource, Not a New Bank Rule

OCC Bulletin 2026-54, dated November 4, gives OCC examiners a framework for evaluating banks' use of super intelligence (SI), the agency's term for technologies previously called artificial intelligence and their advancing capabilities. The bulletin says the framework "does not establish supervisory expectations for banks" and is not intended to set new regulatory expectations, enforceable standards, or prescriptive requirements. Banks are not expected to use it to assess themselves. Existing law still applies: the 22-page framework says SI "does not change the bank's underlying legal obligations."

Examiners should not treat SI as a separate risk category, and banks need not define a separate SI risk appetite. Control intensity could rise with potential consequences, and classification may rest on those consequences, transfer of agency, and human oversight rather than technical sophistication. The PDF calls itself more applicable to generative and agentic SI, which OCC Bulletin 2026-13 left outside its revised model risk guidance.

What the Framework Treats as Consequential

The PDF's own example: a simple rules-based agent authorized to initiate transactions could present greater risk than a sophisticated model limited to internal drafting. Its illustrative tiers place code assistance at Tier 4 but code assistance for internal code or data access changes at Tier 2. A fully autonomous, customer-facing payment agent sits at Tier 1 "regardless of how well it performs in testing."

On evidence, activity outside an approved purpose may be treated as a control failure even when the result appears reasonable, review procedures may be defined so that approval is "more than a nominal click," and inputs, outputs, tool calls, approvals, and overrides may help reconstruct a material decision.

Limits

The tiers are illustrative, and the PDF gives no weights or numeric cutoffs for combining its seven risk factors. Neither document defines transfer of agency. The no-new-expectations statement appears in the bulletin, not the PDF, which says a bank "should consider" how contracts assign responsibility for model-related errors, so the two should be read together. The OCC intends to update the framework. A footnote says it was prepared with SI assistance and approved by a human, without naming a tool or the affected sections. It reports no examination results, so it is not evidence that any bank has these controls or that they work.

Editor's Audit Questions

These are Audit Commons' questions, not OCC text or examination criteria. Where is an agent's authority written down in terms that can be tested? Can someone who did not build the system reconstruct one material action from retained records, including the model, prompt, tool, and permission versions then in force? How often did human reviewers reject or change the agent's work, and did they have the time and authority to do so? Our agent action worksheet offers a related exercise.