The US Office of the Comptroller of the Currency has issued a supervisory framework for examiners reviewing banks’ use of what it calls super intelligence and agentic super intelligence. The document is an examiner resource, not a new rule. It says banks should not be required to create a separate AI risk appetite and examiners should not treat AI as a distinct risk category.
The more useful move is a shift from model sophistication to consequence. Examiners are told to consider the materiality of the use case, the degree of autonomy and the complexity of the system. A relatively simple agent able to initiate transactions may therefore deserve more attention than a powerful model confined to internal research. Reviews should remain proportionate to a bank’s size, complexity and risk profile.
That approach puts familiar controls under fresh pressure. Model risk management, change control, information security, third-party oversight, consumer compliance and operational resilience still apply, but agentic systems can connect them in one workflow. Banks will need evidence of who authorised a use case, which decisions the system may take, how limits are enforced and what happens when behaviour drifts. The OCC says it expects to update the framework as technology and supervisory understanding evolve.
