OCC issues bank AI guidance focused on potential harm, not model complexity

Bank examiners should judge AI by what could go wrong when banks use it—not by how advanced the model is. The Office of the Comptroller of the Currency issued new guidance on November 4, 2026, directing supervisors toward the consequences of mistakes while rejecting AI as a separate category of risk.

The OCC, which oversees large national banks, described the document as its first guidance for examiners assessing banks’ AI use. Reuters reviewed a copy of the guidance. Its instructions address both how supervisors should assess the technology and when a bank’s use of it may warrant tighter controls.

The move follows questions from U.S. banking regulators about lenders’ use of advanced AI models, the limits placed on those systems and how banks monitor them. Regulators worldwide have been examining AI adoption amid concerns about cybersecurity and potential risks to financial stability.

The use matters more than the model

Under the framework, banks are not expected to establish separate risk parameters for AI, and examiners should not treat the technology as a unique risk. The assessment instead takes account of how a lender uses AI, alongside the lender’s size and complexity.

That approach does not make model sophistication the deciding factor. The OCC’s example contrasts a relatively simple system allowed to initiate transactions with a more sophisticated model used internally. The transaction authority can make the simpler system the riskier of the two.

Guidance, not a binding rule

The document is not legally binding like a rule. That distinction limits its formal force, but not necessarily its influence over banks’ decisions: Reuters notes that banks typically comply closely with OCC guidance. The framework therefore sets supervisory expectations without creating a binding regulation.