US bank regulator the Office of the Comptroller of the Currency has issued guidance for examiners assessing banks’ use of AI. The central message is practical: the more authority a bank gives an AI system, and the greater the consequences if it goes wrong, the stronger its controls and human oversight may need to be.
Watch Desk analysis
What happened
The OCC’s guidance applies existing supervisory standards to AI rather than treating it as a separate category of risk, American Banker reports. It sets out six areas for examiners to consider: purpose, potential risks, controls, human oversight, resilience and testing.
Banks are expected to document what each system is for, who can use it, what data and authority it has, and how it is tested. The guidance distinguishes between systems whose actions people approve in advance and those that can act without prior approval. Oversight can be calibrated to factors including potential consequences, autonomy, reversibility and the volume of activity.
The report says the guidance covers uses ranging from customer correspondence and credit decisions to autonomous systems. Banks using third-party AI remain responsible for managing risks from those arrangements, including what provider agents can access and do.
Why it matters
This gives banks a clearer supervisory frame for AI that can make decisions or take actions, rather than simply producing text for an employee to review. A system handling customer messages, payments or credit decisions does not become the bank’s problem only when it misbehaves. The bank remains accountable for the authority it grants and the controls around it.
The guidance also makes risk about more than model sophistication. A relatively ordinary tool can warrant tighter oversight if it has consequential powers, operates at scale or is difficult to reverse. That is a useful distinction for banks deciding where to draw the line between assistance and delegation.
Our read
The most important takeaway is that “the vendor’s AI did it” is not an escape hatch. Banks are being told to understand what their systems can access, what they are allowed to do, and how a person can intervene when the stakes rise. Sensible advice, and rather less glamorous than buying another chatbot.
What to watch
- How examiners apply the guidance to autonomous and higher-consequence systems.
- Whether banks tighten limits on AI agents’ access, actions and third-party connections.
- How institutions document testing, human intervention and responsibility for errors.
Discussion spark: Should banks be allowed to let AI systems take consequential actions without prior human approval if the bank keeps strong controls and remains accountable?
Sources and evidence
- Source update (5 November 2026, 18:42 UTC)
- Source update (5 November 2026, 18:42 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.