How does the OCC regulate AI in banking?

For fifteen years the operative document was the 2011 Supervisory Guidance on Model Risk Management (OCC 2011-12 / Fed SR 11-7). The April 2026 revision modernizes that framework and makes a deliberate scoping choice: generative and agentic AI are called 'novel and rapidly evolving' and carved out of formal model-risk requirements, with banks told to govern them through enterprise risk management instead. The OCC simultaneously rescinded older issuances including its 1997 credit-scoring-models bulletin and 2021 BSA/AML model risk FAQ.

Beyond model risk, the OCC's May 2026 Semiannual Risk Perspective flags AI as a driver of fraud and increasingly fast, sophisticated cyberattacks, and signals that AI governance guidance is on the horizon. The practical posture in 2026 is innovation-friendly: examiners test whether banks understand and control their AI, not whether they use it.

What responsible AI practices are expected of large banks as they innovate with AI?

No US regulator has written an AI rulebook for large banks, but the expectation set is now concrete. For banking organizations above roughly $30 billion in assets, the April 2026 interagency model risk guidance (OCC Bulletin 2026-13, SR 26-2, FIL-15-2026) is the operative standard for every quantitative model: sound development, independent validation with outcomes analysis, effective challenge and board-level governance, scaled to materiality. It deliberately leaves generative and agentic AI to 'broader risk management and governance', which supervisors then examine through third-party (SR 23-4), operational-resilience, cybersecurity and consumer-protection frameworks. Internationally the practices are converging on the FSB's twelve proposed sound practices of June 2026: board-set strategic direction, clear accountability, AI inside the enterprise risk framework, materiality-based risk assessment, data governance, explainability, performance monitoring, human oversight with extra measures for highly autonomous agents, cyber and ICT controls, and third-party AI risk. Supervisors on both sides of the Atlantic describe the same observed practice at large banks in almost the same words: guardrails, human-in-the-loop accountability, and use limited to defined cases.

'Large' has a number in the United States. The April 2026 interagency model risk guidance says it is most relevant to banking organizations with more than $30 billion in total assets, and everything above that line is examined against it: an inventory of models, development evidence, independent validation with outcomes analysis, effective challenge, and a board that owns the framework. Below the line the same disciplines apply proportionately. The guidance replaced SR 11-7 after fifteen years and narrowed the definition of a model to complex quantitative methods — deterministic rules and simple arithmetic are out — which is why the OCC rescinded Bulletins 2011-12, 1997-24 and 2021-19 and the Comptroller's Handbook booklet on the same day.

What large banks actually do is now on the record from supervisors, not vendors. The OCC's Spring 2026 Risk Perspective describes generative and agentic AI use as 'primarily productivity and customer experience enhancement tools', deployed 'with guardrails and human-in-the-loop accountability' and limited to specific cases, while noting banks may expand to 'material financial decisions'. The ECB's Pedro Machado reported in February 2026 that more than 85% of large European banks use AI, with generative and agentic tools accelerating in IT operations, legal and document analysis and front-line support. The EBA's September 2025 survey put EU adoption at 92%, with 55% of banks already using general-purpose or agentic AI in consumer-facing processes. The CFPB found in 2023 that all of the top ten US commercial banks ran chatbots. The UK's 2024 survey found 75% adoption with only 2% of use cases fully autonomous — and the 2026 edition, the first to ask about agentic AI, will publish later this year.

The gap every large bank's AI governance has to bridge is explicit: the 2026 model risk guidance says generative and agentic AI 'are not within the scope of this guidance', and the agencies have promised an interagency request for information on AI and model risk 'in the near future'. Until it lands, four frameworks fill the space. Third-party guidance (SR 23-4) governs the vendor models and cloud-hosted foundation models most banks actually consume — Vice Chair Bowman said in May 2026 supervisors are assessing exactly how it applies to vendor AI. NIST AI 600-1 supplies the control catalogue for generative-AI-specific risks such as confabulation, prompt injection and value-chain integration. NIST's CAISI has an open workstream on AI agent security — indirect prompt injection, misaligned behaviour, constraining and monitoring agent access — from its January 2026 RFI. And the FSB's Sound Practice 10 sets the international expectation that human oversight scales up, not down, as agents become more autonomous.

Direction of travel matters as much as the current rules, and it runs in two directions at once. On adoption, the posture is pro-innovation: Executive Order 14179 and the July 2025 AI Action Plan frame Treasury's February 2026 FS AI RMF; FSOC's 2025 report made 'harnessing AI' a priority and created a standing AI Working Group; the four-roundtable FSOC AI Innovation Series closed in June 2026 with participants asking for regulatory clarity and harmonization; FDIC Chairman Hill told Congress the revised model risk guidance 'supports the use of innovative technology'; HM Treasury's July 2026 plan wants firms 'beyond isolated pilots'; and the PRA's April 2026 plan keeps regulation technology-agnostic. On cyber, the warnings escalate: DFS's May 2026 frontier-AI letter, the ECB's 'Dear CEO' letter of July 2026 requiring AI-cyber action plans by 31 October, the ESAs' July 2026 statement under DORA, and the FSB Chair's 31 August 2026 letter naming frontier models' 'increasingly sophisticated autonomy' as a stability concern. A large bank's responsible-AI programme has to satisfy both audiences with one set of controls.

In practice the examination question is rarely 'do you have a responsible AI policy'. It is whether the bank can show, for any given AI system, which tier it sits in, who owns it, what it was validated against, what a human can override, what the vendor contract lets the bank see, and what happens when it is wrong. The documents above are the sources of each of those questions.

WHAT THIS MEANS IN PRACTICE

• Tier every AI system by materiality before choosing the control set. Above $30 billion, anything that meets the 2026 definition of a model gets full validation; generative and agentic tools get a documented governance path that names which of SR 23-4, NIST 600-1 and the operational-resilience controls apply.
• Write the generative/agentic gap into policy rather than leaving it implicit: the guidance itself says these tools are managed through 'broader risk management and governance' — examiners will ask to see that program.
• Treat vendor AI as a third-party relationship first and a model second. Due diligence, contract audit rights, data-use terms and exit plans are what supervisors are currently assessing for AI vendors.
• Make human-in-the-loop measurable. The observed large-bank practice supervisors praise is not a checkbox; it is a defined reviewer with authority to override, evidence they actually review, and a threshold at which automation stops.
• Fund explainability as a control, not a research project. Hood in 2025, the Risk Perspective in 2026 and the ECB in 2026 all name explainability as the governance issue that limits where AI can be used.
• Give internal audit and compliance an effective-challenge role over AI — the ECB's third expectation and the FSB's second practice — rather than housing all AI oversight in technology.
• Map the cyber warnings to remediation timelines now: human review of AI-generated code, faster patching, dependency maps and logging are what DFS, the ECB and the ESAs asked for in the same eight weeks of 2026.
• Watch for the interagency RFI on AI and model risk management: it is the first federal document that will speak to generative and agentic AI directly, and comment letters from large banks will shape it.

What has the OCC actually published on AI?

Which of the 100 largest US banks answer to the OCC on AI?

39 of the 100 bank pages on this site name the OCC among the authorities their AI programme answers to. Each page lists the documents that apply and why.

• The interagency request for information on model risk management and banks' use of AI (including generative and agentic AI) that the OCC, Fed, and FDIC promised 'in the near future' in Bulletin 2026-13 and repeated in the Spring 2026 Semiannual Risk Perspective — not yet published as of August 26, 2026
• The OCC's stated review of supervisory expectations, guidance, and regulations to 'right-size' AI expectations for community banks that rely on third-party technology (Spring 2026 Semiannual Risk Perspective)
• How examiners treat generative/agentic AI now that it sits outside formal model-risk requirements
• Interaction between the deregulatory 2025–26 posture and consumer-protection enforcement on AI lending