OCC Issues Risk-Based Supervisory Framework for Banks' Use of AI

A client alert from Ballard Spahr reports that the Office of the Comptroller of the Currency has issued a supervisory framework addressing banks' rapidly expanding use of artificial intelligence, framed as a risk-based approach to generative and agentic AI. The alert describes the step as a further move by the OCC to bring AI deployment in banking within a coherent supervisory approach rather than leaving it to piecemeal guidance.

For bank clients and their counsel, the significance is that AI use is now addressed through a dedicated, risk-calibrated supervisory framework, which typically sharpens expectations around governance and board oversight, model validation, data lineage, third-party and vendor risk, and ongoing monitoring of agentic systems that act with a degree of autonomy. At major firms, financial-regulation, technology, and commercial-contracting teams will want to map existing and planned AI use cases against whatever risk categories the framework sets out, and to review vendor arrangements with providers of model and agent services.

What to watch next: the framework's operative detail — any stated effective date, risk-tiering criteria, and new examination procedures — which the alert summarises only in outline, and how OCC examiners apply it in the first review cycle. Treat the alert's characterisation as a secondary summary until the framework text is reviewed directly.