What does OCC Bulletin 2011-12 say about AI in banking?

What are the key points of OCC Bulletin 2011-12?

• Defined a model broadly as a quantitative method that applies statistical, economic, financial, or mathematical theories and assumptions to process input data into quantitative estimates — a definition banks later extended to ML and AI systems.
• Established the three pillars of model risk management: robust development, implementation, and use; sound validation; and governance, policies, and controls.
• Required independent validation with 'effective challenge' — critical analysis by objective, informed parties with the incentives, competence, and influence to force changes.
• Validation components: evaluation of conceptual soundness, ongoing monitoring including benchmarking and process verification, and outcomes analysis including back-testing.
• Called for a firm-wide model inventory and board and senior-management oversight of aggregate model risk.
• Applied to vendor and third-party models, with expectations that banks understand and validate what they buy.
• Rescinded by OCC Bulletin 2026-13 on April 17, 2026; the text remains available in the OCC's rescinded-bulletins archive.

What did OCC Bulletin 2011-12 change for banks?

Because it was the only comprehensive federal statement on model governance, banks and examiners applied it to AI/ML models for over a decade even though it never mentioned AI. Its broad model definition and uniform validation expectations are what the 2026 revision deliberately trimmed. Banks still cite it for the vocabulary — effective challenge, conceptual soundness, outcomes analysis — that carries over into the 2026 guidance.