Overview
- The OCC published the guidance on Nov. 4 as a supervisory framework for examiners and said it will update the document as AI systems evolve.
- The framework is advisory not a new rule and tells examiners to be technology neutral and to focus on the consequences of AI failures rather than model sophistication.
- It outlines four illustrative risk tiers that place fully autonomous payment agents and real‑time credit decision systems in the highest category and recommends safeguards such as rate limits, circuit breakers, emergency shutdowns, independent testing, and required human approval for high‑risk uses.
- The guidance explicitly warns about external or third‑party AI agents and recommends banks use identity checks, delegated permissions, transaction limits, monitoring, and the ability to suspend or revoke agent access to protect customer accounts.
- Although nonbinding, the guidance is likely to change bank practices because firms usually follow OCC guidance and regulators worldwide are already probing AI use; consumers could see stricter controls on automated tools and faster bank responses to rogue agents.