supervisors should evaluate the technology as lenders expand its role in financial services.
The framework instructs examiners to assess how individual banks deploy AI rather than treating the technology as a separate category of risk. They are also expected to consider each institution's size and complexity, focusing on the potential consequences of errors rather than the sophistication of the models used.
The guidance is not legally binding in the way a formal regulation would be, but banks generally follow supervisory instructions closely. It therefore indicates how the US regulator intends to examine AI-related activities as adoption spreads across lending, customer services, fraud detection, compliance, and internal operations.
One example in the document highlights the distinction between technical complexity and operational exposure. A relatively simple AI agent authorised to initiate financial transactions could present greater risk than an advanced model used only for internal analysis. Higher-risk applications may require tighter limits on autonomy or more direct human oversight.
The OCC's approach comes as banking regulators in several jurisdictions increase scrutiny of lenders' AI systems. Supervisors have been asking institutions how they use advanced models, what restrictions are placed on them, and how their performance is monitored. Cybersecurity failures, inaccurate outputs, and poorly controlled automated decisions have become concerns because errors could affect customers, operational resilience, and confidence in financial institutions.
For banks, the guidance reinforces the need to connect AI governance with existing risk-management arrangements. Institutions will need to demonstrate that responsibility for automated decisions is clear, that systems are monitored and that human intervention is available where consequences could be significant.
The framework also reflects a broader regulatory challenge: allowing financial firms to benefit from faster analysis and automation without weakening safeguards around payments, credit and customer data. As AI agents gain the ability to take actions rather than simply generate recommendations, the distinction between experimentation and operational risk is becoming more important.
The OCC has not imposed a new standalone AI rule. Its guidance instead signals that existing supervisory expectations will be applied to the risks created by the way banks use the technology.
