The Office of the Comptroller of the Currency has introduced a new playbook to guide bank examiners in reviewing the use of artificial intelligence. The framework highlights the evolving role of AI in banking activities and outlines risk considerations tied to different AI applications.
- Framework targets generative and agentic AI in banking roles
- Risk assessment integrates AI into existing fraud, privacy, and cybersecurity domains
- Examiners prompted to scrutinize human oversight and vendor contracts
Market signal
The OCC’s new supervisory framework signals intensified regulatory focus on the deployment of AI technologies within banking operations globally, particularly around generative and autonomous AI applications. By setting expectations for examiners to investigate risk controls without introducing new regulatory categories, the framework clarifies how AI fits into existing risk paradigms such as fraud, privacy, and cybersecurity management.
This approach encourages banks to integrate AI risk evaluation into their current compliance programs, treating AI as a factor that modifies traditional risk profiles rather than a standalone element. The classification of AI use cases by risk level—from payment bots to internal memo assistants—highlights where operational changes and additional controls are most necessary.
Operator impact
Vendor relationships also come under greater scrutiny, requiring clear contract terms around liability, change notifications, and risk responsibility when AI functionalities evolve. Failure to manage these areas increases exposure to regulatory action and customer harm. Banks must proactively assess gaps in their risk frameworks to address the OCC’s supervisory expectations.
What to watch next
While the OCC guide is not a binding regulation, it serves as a blueprint for future examinations. Banks should monitor how examiners apply this framework in practice and anticipate detailed inquiries on AI risk management, especially concerning autonomous systems and vendor control mechanisms.
Industry observers should also watch for potential updates or clarifications from the OCC or other regulators that could formalize aspects of this guidance into regulatory mandates. Tech vendors supplying AI solutions to banks will need to adjust their compliance support offerings to fit examiners’ evolving expectations.