What does OCC Bulletin 2026-13 say about AI in banking?

What are the key points of OCC Bulletin 2026-13?

• Defines a model as 'a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates'; simple spreadsheet calculations and deterministic rule-based processes are out of scope.
• Generative AI and agentic AI models are explicitly excluded from the guidance as 'novel and rapidly evolving'; banks are expected to manage them through broader risk-management and governance programs.
• Risk-based approach: model risk management should be commensurate with the bank's size, complexity, and model materiality, rather than a uniform validation standard for every model.
• Most directly relevant to banking organizations with more than $30 billion in total assets; smaller banks are covered only where model risk is significant.
• Covers model development and use, validation and ongoing monitoring, governance and controls, and vendor/third-party models.
• Rescinds OCC Bulletin 2011-12, OCC Bulletin 1997-24, OCC Bulletin 2021-19, and the 'Model Risk Management' booklet of the Comptroller's Handbook.
• Supervisory guidance, not a rule: the agencies state that non-compliance is not itself a basis for supervisory criticism or enforcement action.
• The OCC, Fed, and FDIC say they plan to issue 'in the near future' a request for information on model risk management and banks' use of AI, including generative AI, agentic AI, and AI-based models.

What did OCC Bulletin 2026-13 change for banks?

Before April 2026, SR 11-7 / OCC 2011-12 was applied broadly, and many banks stretched it to cover every algorithm including machine-learning and generative-AI tools. The revised guidance narrows what counts as a model, tilts expectations toward proportionality (with a $30 billion asset marker), and deliberately leaves generative and agentic AI outside formal model-validation requirements. In practice, banks now need two tracks: a slimmer model-risk program for quantitative models, and an enterprise AI governance program for generative and agentic systems that examiners will still probe under safety-and-soundness expectations.