The OCC supervises AI at national banks through model risk management and safety-and-soundness examination — not through AI-specific rules. The landscape changed on April 17, 2026: the OCC, Federal Reserve, and FDIC issued revised interagency model risk management guidance (OCC Bulletin 2026-13) that supersedes the 2011 framework, rescinds OCC 2011-12, and explicitly excludes generative and agentic AI from its scope, leaving those to banks' broader risk-management and governance programs.
| Full name | Office of the Comptroller of the Currency |
| Role | Prudential supervisor |
| Force on banks | Supervisory guidance |
| Applies to | National banks, federal savings associations, and federal branches of foreign banks |
| Key document | OCC Bulletin 2026-13 — Revised interagency Model Risk Management guidance (Apr 2026) |
| Latest move | Apr 2026 revised model risk guidance excluding generative/agentic AI; May 2026 risk report on AI-enabled fraud |
For fifteen years the operative document was the 2011 Supervisory Guidance on Model Risk Management (OCC 2011-12 / Fed SR 11-7). The April 2026 revision modernizes that framework and makes a deliberate scoping choice: generative and agentic AI are called 'novel and rapidly evolving' and carved out of formal model-risk requirements, with banks told to govern them through enterprise risk management instead. The OCC simultaneously rescinded older issuances including its 1997 credit-scoring-models bulletin and 2021 BSA/AML model risk FAQ.
Beyond model risk, the OCC's May 2026 Semiannual Risk Perspective flags AI as a driver of fraud and increasingly fast, sophisticated cyberattacks, and signals that AI governance guidance is on the horizon. The practical posture in 2026 is innovation-friendly: examiners test whether banks understand and control their AI, not whether they use it.
| Date | Type | Document / event |
|---|---|---|
| Apr 4, 2011 | Guidance | Supervisory Guidance on Model Risk Management (OCC 2011-12). The framework that governed bank AI/ML models for 15 years: validation, governance, and effective challenge. Superseded April 2026. |
| Mar 31, 2021 | Consultation | Interagency RFI on AI and machine learning in financial services. OCC, Fed, FDIC, CFPB, and NCUA jointly sought comment on bank AI use — the first coordinated federal look at bank AI. |
| Apr 17, 2026 | Guidance | Revised interagency Model Risk Management guidance (Bulletin 2026-13). OCC, Fed, and FDIC supersede the 2011 guidance; OCC rescinds 2011-12, 1997-24 (credit scoring), and 2021-19 (BSA/AML model risk). Generative and agentic AI are explicitly excluded from scope as 'novel and rapidly evolving.' |
| May 7, 2026 | Report | Semiannual Risk Perspective highlights AI risks. Warns that AI is amplifying fraud and the speed, scale, and sophistication of cyberattacks; signals forthcoming AI governance guidance. |
- Dedicated OCC guidance on AI governance, signalled in the May 2026 Semiannual Risk Perspective
- How examiners treat generative/agentic AI now that it sits outside formal model-risk requirements
- Interaction between the deregulatory 2025–26 posture and consumer-protection enforcement on AI lending
Does SR 11-7 / OCC 2011-12 still apply to AI models?
No — as of April 17, 2026 the 2011 interagency model risk guidance was superseded by revised guidance from the OCC, Federal Reserve, and FDIC (OCC Bulletin 2026-13). Traditional and machine-learning models fall under the revised framework; generative and agentic AI are explicitly excluded and are instead governed through banks' broader risk-management programs.
Why did the 2026 guidance exclude generative AI?
The agencies concluded generative and agentic AI are 'novel and rapidly evolving' — too fast-moving for prescriptive model-validation requirements. Banks are expected to apply enterprise risk management and governance controls instead, and further AI-specific guidance has been signalled.
Is there any binding US federal AI regulation for banks?
There is no AI-specific federal statute for banks. AI use is regulated through existing law — safety and soundness, fair lending (ECOA), UDAP/UDAAP — and supervisory guidance like the 2026 model risk framework. This contrasts with the EU, where the AI Act imposes binding AI-specific obligations.
Follow every move these regulators make
6 curated AI stories for banking executives · Every morning · Free
Subscribe to BankingNewsAI →