# OCC Bulletin 2026-54: Super Intelligence: Supervisory Framework

Source: https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2026-54
Last updated: Nov 7, 2026

OCC Bulletin 2026-54, issued November 4, 2026, transmits the OCC's 'Super Intelligence: Supervisory Framework', a 20-page resource for OCC examiners evaluating banks' use of Super Intelligence (SI) — the OCC's term, under Executive Order 14434, for the technologies previously called artificial intelligence — with a focus on generative and agentic systems. It sets out sixteen framework components grouped into six pillars (purpose, risk, control, oversight, resilience, assurance), an illustrative four-tier, consequence-based risk classification, and a technical lexicon. The bulletin states that the framework does not establish supervisory expectations for banks, sets no enforceable standards or prescriptive requirements, and will be updated as the technology matures; model risk management principles under Bulletin 2026-13 continue to apply to non-generative, non-agentic SI models.

Guide: [OCC Bulletin 2026-54](https://www.bankingnewsai.com/ai-regulation/guides/occ-super-intelligence-framework-explained) — The OCC's November 2026 examiner framework for generative and agentic AI, section by section: definitions, the overarching principle, six pillars, sixteen components, the four illustrative risk tiers, how it fits Bulletin 2026-13, and what to prepare.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [OCC](https://www.bankingnewsai.com/ai-regulation/occ) |
| Type | Framework |
| Status | Final |
| Published | Nov 4, 2026 |
| Applies to | OCC examiners evaluating the use of Super Intelligence (SI) at national banks, federal savings associations, and federal branches and agencies of foreign banking organizations, including community banks; the bulletin states that it does not establish supervisory expectations for banks |
| Official text | https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-54.html |

## Key points

- Issued November 4, 2026 with News Release 2026-97, addressed to the chief executive officers of all national banks, federal savings associations and federal branches and agencies, and signed by James M. Gallagher, Senior Deputy Comptroller and Chief National Bank Examiner.
- 'Super Intelligence' refers to the technologies previously encompassed by the term 'Artificial Intelligence' as defined in 15 USC 9401(3), following Executive Order 14434 (91 Fed. Reg. 63129, October 2, 2026); footnote 1 of the framework says the model risk management principles of Bulletin 2026-13 apply to non-generative and non-agentic SI models, so the framework 'is more applicable to generative and agentic SI'.
- Not a new expectation: the bulletin says the framework 'does not establish supervisory expectations for banks', that banks 'are not expected to use this document to assess their use of SI or their SI risk management', and that nothing in it establishes new regulatory expectations, enforceable standards or prescriptive requirements.
- Examiners 'should not treat SI as a separate and distinct risk category', and banks 'are not required to define a separate SI risk appetite'; SI can introduce, amplify or modify risk in existing categories such as operational, compliance and credit risk, to be managed within the bank's existing risk management framework.
- Overarching principle: a bank's control intensity could increase with the potential consequences of an SI agent's failure or misuse — higher-consequence use cases may warrant greater restrictions on autonomy, stronger controls, more direct human oversight, more independent validation and more robust resilience — with classification based on consequences, transfer of agency and the degree of human oversight rather than technical sophistication.
- Sixteen framework components in six pillars: defined purpose and permitted use; risk classification and criticality assessment; human-in-the-loop and human-on-the-loop controls; governance and accountability; model risk management extensions; data governance; privacy; compliance; third-party and vendor risk; operational resilience; cybersecurity; performance monitoring; testing; documentation and auditability; internal audit and independent challenge; reporting and transparency.
- Illustrative risk tiering: seven factors (decision consequence, reversibility, customer/financial impact, autonomy level, data sensitivity, explainability, provenance) combine into a composite tier from Tier 1 'Critical' (autonomous payment agent, real-time credit decisioning, fraud-hold release, market access) to Tier 4 'Low' (internal productivity tools, code assistance, general employee Q&A).
- Examiners may use the framework for community banks, tailored to the bank's size, complexity and risk profile; the OCC intends to update the framework regularly, and discloses that it was prepared with the assistance of SI and 'reviewed, edited, and approved by a human'.

## What changed for banks

Until November 2026 the OCC's formal position on generative and agentic AI was the carve-out in Bulletin 2026-13: those systems were 'not within the scope' of model risk management and were left to banks' broader risk-management and governance programs, with an interagency request for information promised. Bulletin 2026-54 fills the gap from the examiner's side. It tells OCC examiners what to look at when a bank runs a generative or agentic system — purpose boundaries, human-in-the-loop or human-on-the-loop controls, hallucination testing, prompt-injection defences, kill switches, provider-agent visibility, SI incident vocabularies — and how to scale their attention to the consequences of the use case through an illustrative four-tier classification. It does not amend Bulletin 2026-13 or the 2023 interagency third-party guidance, which it says SI third-party risk management 'may supplement', and it creates no obligations. It is also the first OCC bulletin to adopt the 'Super Intelligence' terminology of Executive Order 14434, after the SEC's FY2027 examination priorities and the CFTC had done so in October 2026.

## Use cases it governs

- [Generative & agentic AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#generative-agentic-ai)
- [AI governance (general)](https://www.bankingnewsai.com/ai-regulation/by-use-case#governance-general)
- [Model risk management](https://www.bankingnewsai.com/ai-regulation/by-use-case#model-risk)
- [Third-party & vendor AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#third-party-vendors)
- [Cybersecurity](https://www.bankingnewsai.com/ai-regulation/by-use-case#cybersecurity)
- [Data & privacy](https://www.bankingnewsai.com/ai-regulation/by-use-case#data-privacy)
- [AML / KYC](https://www.bankingnewsai.com/ai-regulation/by-use-case#aml-kyc)
- [Customer-facing chatbots](https://www.bankingnewsai.com/ai-regulation/by-use-case#customer-chatbots)
- [Credit scoring & underwriting](https://www.bankingnewsai.com/ai-regulation/by-use-case#credit-underwriting)
- [Fraud detection](https://www.bankingnewsai.com/ai-regulation/by-use-case#fraud)
- [Trading & capital markets](https://www.bankingnewsai.com/ai-regulation/by-use-case#trading-markets)
- [AI-generated code & coding agents](https://www.bankingnewsai.com/ai-regulation/by-use-case#ai-generated-code)

## What is the difference between OCC Bulletin 2026-13 and OCC Bulletin 2026-54?

OCC Bulletin 2026-13 (April 17, 2026) is interagency supervisory guidance on model risk management for traditional statistical models and non-generative, non-agentic AI models; it was issued with the Federal Reserve (SR 26-2) and the FDIC (FIL-15-2026), is addressed to banks, and sets out principles for model development, validation, governance and vendor models. OCC Bulletin 2026-54 (November 4, 2026) is an OCC-only resource for examiners on banks' use of 'Super Intelligence', focused on generative and agentic systems, with sixteen components, six pillars and an illustrative four-tier risk classification; the bulletin says it establishes no supervisory expectations for banks. Footnote 1 of the framework draws the line: the model risk principles of 2026-13 apply to non-generative and non-agentic SI models, and the framework 'is more applicable to generative and agentic SI'. Neither document supersedes the other.

| Rule | Authority | What it requires | Status | Source |
| --- | --- | --- | --- | --- |
| OCC Bulletin 2026-13 (SR 26-2 / FIL-15-2026) | [OCC](https://www.bankingnewsai.com/ai-regulation/occ) | Interagency model risk management guidance for traditional and non-generative, non-agentic AI models: development and use, validation and monitoring, governance and controls, vendor models; most relevant above $30 billion in assets; generative and agentic AI out of scope. | In force since Apr 17, 2026 | [OCC Bulletin 2026-13](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2026-13) |
| OCC Bulletin 2026-54 (Super Intelligence: Supervisory Framework) | [OCC](https://www.bankingnewsai.com/ai-regulation/occ) | OCC examiner resource for banks' use of SI, 'more applicable to generative and agentic SI': sixteen components in six pillars, consequence-based tiering, a lexicon; no supervisory expectations, enforceable standards or prescriptive requirements for banks. | Issued Nov 4, 2026; to be updated regularly | [OCC Bulletin 2026-54](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2026-54) |
| Super Intelligence Supervisory Framework — full text (PDF) | [OCC](https://www.bankingnewsai.com/ai-regulation/occ) | The 20-page framework itself: executive summary, overarching principle, six pillars, the sixteen components with illustrative considerations, the summary table of SI-specific risks, the tiering methodology and tier definitions, and Appendix A lexicon. | Nov 4, 2026 | [official text](https://www.occ.gov/news-issuances/news-releases/2026/nr-occ-2026-97a.pdf) |
| OCC Bulletin 2023-17 (interagency third-party risk guidance) | [OCC](https://www.bankingnewsai.com/ai-regulation/occ) | The lifecycle guidance for vendor relationships that the framework says SI third-party risk management 'may supplement': planning, due diligence, contracting, ongoing monitoring, termination. | In force since Jun 6, 2023 | [OCC Bulletin 2023-17](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2023-17) |

The simplest way to hold the two bulletins apart is by audience and by system. Bulletin 2026-13 is written to banks and tells them how to manage model risk; Bulletin 2026-54 is written to examiners and tells them how to look at a bank's generative and agentic SI. Bulletin 2026-13 is interagency and carries the Federal Reserve's and FDIC's numbers; Bulletin 2026-54 is an OCC document alone. Bulletin 2026-13 defines a model as a 'complex quantitative method' and excludes generative and agentic AI from that definition; Bulletin 2026-54 starts from the systems that exclusion left out and asks whether their purpose is bounded, their autonomy proportionate to consequence, their human oversight meaningful, their data governed, their vendors visible, their failures containable and their behaviour testable and auditable.

Where the two overlap is the 'Model Risk Management Extensions' component of the framework, which says certain MRM principles 'may be instructive' for generative and agentic systems — development, use, validation, governance and ongoing monitoring — but that their scope, frequency and independence may need adapting to non-determinism, continuous change and reliance on third-party or continuously updated models. The framework's lexicon also borrows model risk management's definitions of model risk, benchmarking, performance monitoring and validation, so a bank's existing MRM vocabulary carries over even where the formal guidance does not.

What has not changed: the interagency request for information on model risk management and banks' use of AI, promised 'in the near future' in Bulletin 2026-13, had still not been published when Bulletin 2026-54 appeared, and the framework does not mention it. The framework is also silent on the Federal Reserve and FDIC, which have issued no equivalent examiner document.

### What this means in practice

- Keep two inventories, or one inventory with two control sets: models under Bulletin 2026-13 (validation scaled to materiality) and generative or agentic SI use cases whose controls follow the consequence-based logic of Bulletin 2026-54.
- Re-point internal policy language: the phrase 'generative and agentic AI are outside model risk management' is now incomplete without 'and are what OCC examiners will assess under the Super Intelligence framework'.
- Where a system sits on the border — a machine-learning scorecard wrapped in an agent that acts on its output — expect examiners to apply 2026-13 to the model and 2026-54 to the agent around it.

## FAQ

### Is OCC Bulletin 2026-54 mandatory for banks?

No. The bulletin says the framework 'does not establish supervisory expectations for banks' and is 'intended as a resource to assist examiners in their supervisory activities'. Banks are not expected to use it to assess their own SI use, and nothing in it sets enforceable standards or prescriptive requirements. It does, however, describe what OCC examiners will look at, so it is the best available map of the questions a bank running generative or agentic AI will be asked.

### Does OCC Bulletin 2026-54 replace Bulletin 2026-13?

No. Bulletin 2026-13 (the revised interagency model risk management guidance of April 17, 2026) remains in force for traditional and non-generative, non-agentic AI models. Footnote 1 of the framework says those model risk principles apply to non-generative and non-agentic SI models and that the framework itself 'is more applicable to generative and agentic SI'. The two documents cover different systems and neither supersedes the other.

### What are the four risk tiers in the OCC Super Intelligence framework?

Tier 1 'Critical' (direct action, low or no reversibility, high financial or customer impact, autonomous or partially autonomous — e.g. an autonomous payment agent or real-time credit decisioning), Tier 2 'High' (direct action or high-weight decision support with a human on the loop — e.g. SI-assisted underwriting, agent-initiated customer communications, AML alert disposition), Tier 3 'Moderate' (decision support with a mandatory human in the loop, limited data sensitivity, reversible — e.g. summarising documents for credit memos) and Tier 4 'Low' (no customer or financial data exposure, no direct action, fully human-controlled — e.g. internal productivity tools and general employee Q&A). The OCC calls the tiering 'illustrative'.

### Does the OCC Super Intelligence framework apply to community banks?

Examiners may use it when supervising community banks' SI use, but the OCC has instructed them to tailor examinations to the bank's size, complexity and risk profile, proportionate to the nature, consequences, autonomy and complexity of its SI use cases. Like the rest of the framework, it imposes no requirement on the bank itself.

## Related documents

- [OCC Semiannual Risk Perspective, Spring 2026](https://www.bankingnewsai.com/ai-regulation/documents/occ-semiannual-risk-perspective-spring-2026) — Semiannual Risk Perspective from the National Risk Committee, Spring 2026 (May 7, 2026)
- [OCC Bulletin 2026-13](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2026-13) — Model Risk Management: Revised Guidance (Apr 17, 2026)
- [Acting Comptroller Hood, 'AI in Financial Services' (Apr 2025)](https://www.bankingnewsai.com/ai-regulation/documents/occ-hood-responsible-ai-speech-2025) — Remarks by Acting Comptroller Rodney E. Hood at the National Fair Housing Alliance's Responsible AI Symposium: 'AI in Financial Services' (Apr 29, 2025)
- [OCC Bulletin 2023-17](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2023-17) — Third-Party Relationships: Interagency Guidance on Risk Management (Jun 6, 2023)
- [OCC Bulletin 2021-19](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2021-19) — Bank Secrecy Act/Anti-Money Laundering: Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML Compliance and Request for Information (Apr 9, 2021)
- [2021 Interagency AI RFI (OCC Bulletin 2021-17)](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2021-17-ai-rfi) — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021)
- [OCC Bulletin 2011-12](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2011-12) — Sound Practices for Model Risk Management: Supervisory Guidance on Model Risk Management (Apr 4, 2011)
- [OCC Bulletin 1997-24](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-1997-24) — Credit Scoring Models: Examination Guidance (May 20, 1997)

Last reviewed Nov 7, 2026. Cite the official text (https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-54.html) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2026-54
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (45 authorities, 268 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.