What the OCC’s AI supervisory framework means for banks

Four aspects stand out in the framework:

1. Greater AI autonomy can mean greater risk. An important consideration is how much decision-making or operating authority has shifted from people to technology. The OCC’s framework calls this the “transfer of agency.”

   An AI application that recommends an action presents a different risk profile from one authorized to carry it out without prior human approval.

2. What an AI system can affect matters more than how advanced it sounds. A sophisticated AI assistant with no access to customer records or financial systems could present less risk than a simpler application authorized to affect payments or a credit decision. Banks need to consider what could happen if the technology makes a mistake, behaves out-of-the-norm or is misused, as well as whether the resulting action can readily be remedied.
3. Placing a human in the process does not automatically make it safe. Employees charged with reviewing AI-supported decisions need sufficient knowledge, business acumen, critical thinking, information, time and authority to credibly challenge the output and intervene when necessary. Otherwise, human approval risks becoming procedural rather than an effective safeguard.
4. Policies alone are unlikely to demonstrate effective governance. Banks should be prepared to show how their AI safeguards work in practice through testing, monitoring, records, escalation processes and independent review. This is vital as AI deployments extend to customer interactions, financial transactions and other material activities.

One of the most important constructs in the framework is the attention placed on what AI systems are empowered to do.

The sophistication of the technology alone does not determine the severity of the risk. A technically sophisticated AI system used primarily for internal research may carry relatively limited exposure. An agent authorized to change a customer record, initiate an action or influence a consequential decision may warrant considerably greater attention.

For bank leaders, that shifts the risk conversation from “How advanced is this AI system?” to “What authority have we given it, what happens if it is wrong and can we correct the result?”

The OCC illustrates this idea through a four-tier methodology showing how AI uses can differ according to their potential impact and degree of human involvement:

• Tier 1, Critical: Autonomous or partially autonomous activities with significant financial/customer consequences and low reversibility, including autonomous credit decisioning, payment release and real-time market access.
• Tier 2, High: High-impact decision support or actions with human oversight, such as underwriting assistance and anti-money laundering alert disposition.
• Tier 3, Moderate: Reversible decision support requiring human involvement.
• Tier 4, Low: Human-controlled productivity applications without customer or financial exposure.

The methodology is simply illustrative, not a universal classification banks are required to adopt.

This approach also should influence how banks design human oversight. The framework uses the terms “human-in-the-loop” and “human-on-the-loop.” The practical distinction is that in-the-loop oversight keeps humans directly involved in important decisions and their intervention is built into the workflow, while on-the-loop oversight gives the technology greater latitude and autonomy to operate while humans monitor and intervene when necessary.

The right human oversight model depends on the specific AI application. An application assisting an employee with an internal draft may reasonably operate with relatively light intervention. An AI agent capable of making decisions, changing records or interacting with customers may require tighter limits and more direct human participation and intervention.

Some banking institutions may view a highly restrictive approval process as evidence of strong governance. If few proposed AI use cases make it through the approval process, the assumption can be that AI risk is being controlled.

However, low approval rates do not necessarily demonstrate sound risk management. They can also indicate that decision-makers lack the information, confidence or risk-assessment methods needed to distinguish acceptable use cases from unacceptable ones.

That creates at least two risks. Banks can move too quickly and introduce AI without sufficient safeguards, but they can also become so cautious that potentially valuable AI applications are rejected or delayed unnecessarily.

The objective should be informed risk-taking, not risk avoidance. Leaders need an AI risk and governance process capable of differentiating among uses of AI according to their real consequences, and then applying controls proportionate to those consequences. This requires education at the board and executive levels as well.

The OCC’s framework also has implications for the economics of AI adoption.

The financial case for automation typically focuses on efficiency, productivity, cost-takeout and capacity gains. However, banking institutions also need to consider what it will cost to operate AI technology within an acceptable risk profile. Testing, monitoring, documentation and human intervention can add considerable expense, particularly for consequential AI applications.

This can create an important trade-off. If an AI agent is expected to automate a process but safe operation requires substantial human approval at multiple points, some of the envisioned AI efficiency advantage may disappear. The more consequential question then becomes whether the remaining economic benefit justifies using an autonomous AI system rather than a more traditional process.

Speed and control can sometimes conflict. Institutions should be prepared to explain why the level of human intervention or oversight and other safeguards selected for a particular AI use case are appropriate for the authority granted to the AI, rather than choosing lighter controls primarily to reduce expense or accelerate execution.

The result is a broader way of evaluating AI return on investment: What value does the AI application create after accounting for the controls required to operate it responsibly and the potential financial effects if those controls fail?

As AI becomes more capable of acting independently, banks also need evidence of how these AI systems behave after live deployment. This makes ongoing testing an important practical consideration, particularly because maintaining confidence that AI continues to operate as intended can create a substantial workload. Documentation is equally important for supporting internal audit and other forms of assurance.

Human reviewers also cannot assume that an AI-generated result is reliable simply because a machine produced it. Employees may sometimes accept AI output with less scrutiny than they would otherwise apply to work produced manually. Human oversight is valuable only when the person involved evaluates the result and has the ability to credibly challenge the output and/or intervene when necessary.

For bank leaders, the immediate response should not be to create an entirely new AI risk infrastructure. Instead, they should use the OCC framework to test whether existing practices adequately account for the inherent risks of AI and agentic systems.

We recommend these near-term priorities:

Banks need a more disciplined way to decide where greater AI autonomy makes practical and business sense and where it does not. The OCC’s framework gives banking institutions a clearer basis for making those informed decisions without abandoning the enterprise risk management and governance structures they already have in place.