OCC Issues Super Intelligence Supervisory Framework
The Office of the Comptroller of the Currency ("OCC")'s framework provides a basis for examiners to evaluate a bank's use of "Super Intelligence" ("SI")—as mandated by Executive Order 14434. The OCC is using the term SI to cover technologies previously termed "artificial intelligence" ("AI") under 15 U.S.C. § 9401(3). Rather than treating these technologies as a stand-alone risk category, it embeds them within existing risk categories and appetites. The framework shifts the focus from the technologies, to how the technologies are used.
On November 4, 2026, the OCC issued OCC Bulletin 2026-54, "Super Intelligence: Supervisory Framework," covering national banks, federal savings associations, and federal branches and agencies of foreign banking organizations.
Supervisory Status. While the framework is an examiner resource, not a source of enforceable standards, it may be referenced by examiners when evaluating a bank's SI/AI use during upcoming examinations. The new framework specifically targets advanced generative and autonomous "agentic SI" deployments not traditional non-generative models already covered under previous guidance.
Proportional Controls. Instead of tying the intensity of controls to the complexity of the underlying technology or model, the guidance instructs controls to be proportional to the potential consequences of an SI/AI agent's failure or misuse. An illustrative four-tier graduated control methodology helps assess how controls should be scaled. Tier 4 represents the lowest risk, where there is no exposed customer or financial data and use is human controlled. Tier 1 represents the most critical risk, where customer or financial impact is possible and SI/AI has significant autonomy.
Impact to Established Controls. The framework presents 16 components describing how SI/AI may affect existing control areas and identifying SI/AI-specific risks. Notable themes for specific risk considerations include permitted-use boundaries, kill switches for agents acting incorrectly, and defenses against prompt injection. Examiners are instructed to use risk-based judgement, weighing the nature, consequences, autonomy, and complexity of the banks' SI/AI use.
Looking Ahead. Although the framework does not establish new requirements, it does preview how examiners will evaluate a bank's use of SI/AI under existing standards. Banks should consider whether their SI/AI use cases have been appropriately documented and addressed in existing governance, risk management, and operational frameworks. Counsel can assist with developing a comprehensive methodology to assess these frameworks in light of the new SI/AI framework.
