Before anyone turns the OCC's latest AI document into another mandatory implementation project, read the opening paragraphs. The distinction between an examiner resource and a new bank requirement is doing real work here.
On November 4, the OCC issued its “Super Intelligence” supervisory framework for examiners. The bulletin explicitly says the framework does not establish new supervisory or regulatory expectations, enforceable standards, or prescriptive requirements for banks.
Our read: the useful conversation is about what a system can do, what happens if it fails and how much authority the institution has delegated. That is more productive than arguing over how impressive the model sounds.
The framework is a resource to help examiners evaluate the use of technology in normal-course banking activities. The OCC says banks are not expected to use the document to assess their own use or risk management.
The bulletin also clarifies that examiners should not treat SI as a separate risk category, and banks need not define a separate SI risk appetite. It describes considerations that may supplement existing model-risk, governance, technology, compliance, and operational-risk practices, rather than replacing them.
The agency's terminology should not obscure the scope. Its footnote uses “Super Intelligence” to encompass technologies previously covered by “Artificial Intelligence,” as well as their advancing capabilities.
The OCC says use-case classification may reflect potential consequences, transfer of agency and human oversight rather than technical sophistication. That distinction gives lending executives a useful way to separate decisions that would otherwise be bundled into a single “AI strategy.”
Consider two hypothetical tools. One drafts a missing-document reminder for an employee to review; the other changes information used in a credit decision without a prior human check.
Both may use similar technology. They should not receive identical authority merely because procurement puts them in the same category.
Our recommendation is to describe the permitted action first. “Summarizes,” “recommends,” “changes,” and “executes” are more useful verbs in a control discussion than “AI-powered.”
Policy is the moat when the institution can translate its decisions into operating boundaries. We suggest documenting four things for each proposed use case.
These are recommended management practices, not newly mandated controls from this bulletin. Their purpose is to make deployment choices reviewable, not to impose a compliance obligation.
For community banks, the OCC instructs examiners to tailor reviews to size, complexity and risk profile, proportionate to the nature, consequences, autonomy and complexity of use cases. The document also says that control intensity could increase due to the potential consequences of an agent's failure or misuse.
Our recommendation is to use that proportionality as a discipline, not a slogan. A bounded administrative assistant and an automated action affecting a borrower deserve different evaluation, even inside a smaller institution.
Build on existing infrastructure where it supports clear permissions and reliable records. Add controls for the actual use case; do not create a parallel operating environment simply to make a pilot look modern.
Replace “Should we allow AI?” with a more useful discussion: what action are we considering, under whose authority, with what evidence, and what recovery plan? Start with a bounded workflow and expand only after its performance and failure handling have been tested.
An optional examiner resource is not permission to stop thinking. Nor is it an invitation to invent a mandatory transformation program that the regulator did not request.
No. The OCC explicitly says it does not establish new supervisory or regulatory expectations, enforceable standards, or prescriptive requirements.
The bulletin says examiners should not treat SI as a separate risk category and banks are not required to define a separate SI risk appetite. That should not be read as an exemption from otherwise applicable obligations.
Its definition of banks includes national banks, federal savings associations, and federal branches and agencies of foreign banking organizations. It is not a universal mandate from every US financial regulator.
Use it as context for an internal discussion, not as a newly required implementation checklist. Our recommendation is to distinguish use cases by delegated actions, potential consequences, human oversight, and the evidence needed to review them.