OCC Gave Examiners a Playbook. Most Banks Can't Pass It.

For years, banks have been building AI governance programs organized around one implicit principle: the more sophisticated the model, the more scrutiny it deserves. Large language models got model risk committees. Complex credit scoring engines got detailed validation frameworks. The internal chatbot your compliance team uses to draft memos? That went through IT change management and called it a day.

OCC Bulletin 2026-54, issued November 4, 2026, is a direct repudiation of that logic. The bulletin — the first examiner-facing framework explicitly covering generative and agentic AI in US banking — does not ask examiners to evaluate how sophisticated a bank’s AI is. It asks them to evaluate what happens when it goes wrong. That is not a subtle shift in regulatory framing. It is a structural inversion that exposes exactly how most bank AI governance programs are built.

Regulatory & Compliance Angle

The bulletin is formally titled “Super Intelligence: Supervisory Framework” and applies to all OCC-supervised institutions: national banks, federal savings associations, and federal branches and agencies. The OCC characterized “Super Intelligence” (SI) as encompassing generative AI, agentic AI, and AI systems capable of autonomous or semi-autonomous action — the category that falls outside the explicit scope of OCC Bulletin 2026-13 (SR 26-2), the April 2026 joint guidance on model risk management that the agencies explicitly scoped to exclude generative and agentic AI.

That scope gap was not accidental. The agencies acknowledged at the time that generative and agentic AI pose distinct governance challenges that the SR 11-7-descended MRM framework was not designed to address — and committed to separate guidance. Bulletin 2026-54 is that guidance, at least for OCC examiners. It does not create new enforceable standards and is not a self-assessment tool — the bulletin itself says so. Banks are not expected to adopt its taxonomy directly. What it does create is an examiner lens: a structured analytical framework that will organize how OCC examiners ask questions, request documentation, and form supervisory conclusions about AI risk during examinations.

The framework is organized around six pillars — Purpose, Risk, Control, Oversight, Resilience, and Assurance — covering 16 governance components. Those components span governance and accountability, model risk management, data governance, privacy, compliance, vendor risk, operational resilience, cybersecurity, performance monitoring, testing, documentation, internal audit, and reporting. Any bank that believed its existing model risk or operational risk framework fully addressed generative AI governance should read that list carefully. Several of those components require documentation and testing approaches that standard MRM frameworks were not built to generate for non-deterministic, frequently changing, or third-party foundation models.

The four-tier risk classification — Critical, High, Moderate, and Low — is what distinguishes this bulletin from earlier OCC AI guidance. Tier placement depends on consequence and reversibility, not technical complexity. A Tier 1 (Critical) system is characterized by autonomous or semi-autonomous action, low reversibility, and high financial or customer impact — autonomous payment agents, real-time credit decisioning, fraud-hold release, and market access systems are the illustrative examples. A Tier 2 (High) system involves direct action or heavily-weighted decision support with a human on the loop — AI-assisted underwriting, agent-initiated customer communications, and AML alert disposition sit here. Tier 3 covers reversible decision support with mandatory human review. Tier 4 covers fully human-controlled internal tools with no customer or financial data exposure.

The practical implication is that a simple, rules-based agent authorized to initiate wire transfers ranks as Critical under this framework — higher than a sophisticated foundation model used only to generate internal research summaries. Banks that have invested heavily in validating their most complex models while treating their most consequential agentic workflows as operational tools rather than model risk exposures will find that their governance programs are inverted relative to the examiner’s classification.

What the Examiner Will Find

The first thing an examiner will request is an AI use-case inventory. The bulletin is explicit that vendor-embedded AI features must be included. That is a materially higher bar than most banks’ current AI registers. Many banks maintain inventories of internally developed models and explicitly procured AI products. What they typically do not track is AI functionality embedded in existing SaaS products — the AI features that vendors have switched on in core banking, loan origination, document management, and customer service platforms over the past 18 months. The bulletin’s vendor risk section puts direct accountability on the bank: you cannot tell an examiner you didn’t know your document management vendor added AI-powered contract analysis last quarter. That is a control failure.

For each inventory entry, examiners will expect an identified accountable owner, a consequence tier, and documentation of the system’s authorized purpose. That last point is more operationally significant than it sounds. The bulletin notes that activity outside an approved purpose may be treated as a control failure even when the output appears reasonable. Agentic systems that have drifted — through prompt modification, tool addition, or workflow integration — beyond their originally defined purpose create this exposure regardless of output quality.

Oversight documentation will be scrutinized for substance. The bulletin distinguishes human-in-the-loop (human reviews and approves before action) from human-on-the-loop (human monitors an independent system and can intervene), and it frames the adequacy of oversight in terms of genuine authority and capacity. The direct quote that will define examinations: a nominal approval process that amounts to little more than clicking a button will not necessarily provide meaningful oversight. Banks that have documented human oversight through workflow steps that no one actually stops to exercise — bulk approval queues, alert fatigue-driven auto-advance, or nominal review steps inserted to satisfy audit requirements — have exactly this exposure.

Kill switches and circuit breakers will be specifically evaluated under the Resilience pillar. For Tier 1 and Tier 2 systems, examiners will look for tested fallback procedures, emergency shutdown mechanisms, and customer remediation processes. The testing requirement matters: having a kill switch on paper is not the same as having demonstrated it works under production conditions with real data.

Consumer compliance receives specific attention. The bulletin identifies AI-generated errors in customer-facing communications — hallucinated fees, interest rates, account status, and bank policies — as sources of regulatory liability. Suggested controls include limiting automated representations, requiring verification for higher-impact customer interactions, and enabling prompt correction. The compliance point is blunt: AI-generated errors do not reduce the bank’s compliance obligations. This is not a novel legal position, but it is the first time it has appeared explicitly in OCC examiner guidance.

The Governance Gap

The governance gap the bulletin exposes is structural, not procedural. Most bank AI governance programs were built on the same analytical foundation as model risk management: a model is risky in proportion to its complexity, its use in high-stakes decisions, and the volume of decisions it touches. That foundation made sense for statistical credit models. It does not map cleanly onto a production environment where a simple three-step agentic workflow can initiate irreversible financial transactions at machine speed.

Consequence-based governance requires banks to answer a different set of questions than sophistication-based governance. It’s not “how does this model work?” but “what can this system do without human review, and what breaks if it does the wrong thing?” Those questions expose gaps in vendor oversight that sophistication-based governance tends to miss entirely. Banks negotiate model validation terms with AI vendors for systems they explicitly procure. They rarely negotiate equivalent terms for AI features added to existing software through a routine product update. The bulletin’s vendor risk section is a direct call to close that gap: banks need to know what AI functionality their existing vendors have switched on, what data those features access, whether they can monitor and test third-party system behavior, and whether their contracts address change notice, liability allocation, and the right to restrict or terminate AI features.

The timing matters. Vendors have been adding generative AI capabilities to banking software at a pace that substantially outran procurement and change management processes. Release notes from the past 12 months are likely to contain AI feature additions that never triggered an MRM review or an AI governance committee discussion. The bulletin’s inventory requirement effectively requires a retroactive audit of that period.

The examiner’s toolkit under this framework is significantly more capable than under traditional MRM-based guidance. Because the bulletin frames agentic AI risk through the operational, compliance, credit, and third-party risk frameworks, examiners can apply existing supervisory tools — operational resilience reviews, third-party management assessments, consumer compliance examinations — to AI systems that would not have triggered a formal model risk review. A bank that has not prepared its operational resilience or vendor management documentation for agentic AI use cases is exposed through multiple supervisory channels, not just the model risk team.

The SuperML Take

Bulletin 2026-54 is not a heavy-handed regulatory intervention. It creates no new enforceable rules. It does not require banks to adopt the four-tier taxonomy or restructure their AI governance committees. What it does — and this is what makes it consequential — is hand examiners a coherent analytical framework for asking hard questions about AI systems that banks have been treating as outside the regulatory perimeter.

The sophistication-consequence inversion is the core insight and the core risk. If your bank’s AI governance is organized to give the most scrutiny to your most sophisticated models, you have exactly the wrong framework for the examination environment that Bulletin 2026-54 creates. A T1 payment agent running on a rules-based architecture with zero ML components is higher consequence than a state-of-the-art foundation model running in a sandboxed research environment with no production action authority. The examiner’s first question is about consequence and reversibility, not architecture.

The vendor exposure is the near-term operational priority. Most banks have not performed a systematic review of AI features added to existing vendor products in 2025 and 2026. The bulletin’s inventory requirement makes that a supervisory expectation, and the third-party management framework gives examiners standing to review vendor contracts, change management procedures, and monitoring capabilities. Banks that cannot demonstrate awareness of what their vendors have switched on are going to have a difficult first conversation with an examiner who arrives with the bulletin’s inventory checklist.

The kill switch requirement deserves particular attention from engineering teams. The bulletin frames the adequacy of an intervention mechanism in terms of actual tested performance under production conditions — not design intent or workflow documentation. Banks that have implemented nominal kill switches or rate limits on paper but have not load-tested them against production traffic patterns, have not validated fallback procedures with real customer data, and have not documented a customer remediation process for the interval between failure and shutdown are carrying a gap that the Resilience pillar will surface.

The examiner guidance also arrives in a specific regulatory context. SR 26-2 excluded agentic AI from scope. The joint agencies committed to addressing that gap. Bulletin 2026-54 addresses it, at least for OCC-supervised institutions. Banks that interpreted the SR 26-2 exclusion as a signal to defer agentic AI governance work until clearer guidance arrived have now received that guidance. The window for “we’re waiting for regulatory clarity” has closed.

Sources

• OCC Bulletin 2026-54 — Super Intelligence: Supervisory Framework (OCC, Nov 4, 2026)
• OCC Issues Supervisory Framework for Banks’ Use of “Super Intelligence” (Ballard Spahr / Consumer Finance Monitor, Nov 6, 2026)
• OCC AI Framework: Consequences, Not Sophistication, Drive Scrutiny (Forvis Mazars, Nov 5, 2026)
• OCC Guide Says Bank AI Risk Depends on Failure, Not Sophistication (Beri.net, Nov 5, 2026)
• OCC Gives Examiners A Playbook For Bank Use Of “Super Intelligence” (Forbes, Nov 5, 2026)
• OCC Releases Strict Supervisory Framework for Bank AI Use (PYMNTS, Nov 2026)
• OCC releases framework for supervising artificial intelligence (ABA Banking Journal, Nov 2026)
• OCC Super Intelligence Framework Targets AI Risks in AML (Fincrime Central, Nov 2026)
• US Bank Regulator Issues First AI Framework as Banks Battle Rogue Agents (Decrypt, Nov 2026)