The Office of the Comptroller of the Currency (OCC), the federal agency that oversees national banks, federal savings associations and federally licensed branches and agencies of foreign banks, issued a guide on Wednesday, Nov. 4, for how its examiners should look at banks' use of AI. The agency calls the technology "Super Intelligence," a term it uses, citing a presidential executive order, for what had been called artificial intelligence, including its fast-improving abilities. The guide's main idea is that an AI system's risk may depend more on what it is allowed to do than on how sophisticated it is.
The guide is aimed mainly at AI that creates content, such as text or images, or acts on its own. Other AI models, ones that neither create content nor act on their own, stay under the model risk guidance the OCC already has. An AI agent is AI that can carry out tasks on its own, such as using apps and websites, instead of only answering questions. The guide says "a simple rules-based agent authorized to initiate transactions could present greater risk than a sophisticated model limited to internal drafting assistance." A rules-based agent is one that follows fixed instructions.
A bank may sort each AI use by risk based on what happens if it fails, how much the AI acts on its own, and how closely people watch it. The guide sorts uses into four example tiers. The riskiest, called critical, includes an AI agent that makes payments by itself, credit decisions made in real time, and releasing money held for suspected fraud. A fully automatic payment agent that serves customers sits in that top tier "regardless of how well it performs in testing," the guide says in one example. The lowest tier covers office helpers that touch no customer or financial data and take no action, such as general coding help and answering staff questions. Coding help that changes a bank's internal code or who can reach its data sits in the second-highest tier.
The guide also says banks may set rules so that a person's sign-off is "more than a nominal click," and that a heavy load of approvals could make people check less carefully. It warns that AI answers that confidently make up fees, rates, account status or policies could add to a bank's legal risk or harm to customers. On outside vendors, the guide says contracts may spell out whether a vendor can use a bank's data to train or improve AI it offers to its other clients. The OCC adds that the guide itself was written with help from AI, and that a person reviewed, edited and approved it.
Examiners are told not to file AI under a risk category of its own, and banks don't need a separate statement of how much AI risk they are willing to take. The guide says AI can instead add to or change risks banks already manage, such as lending and day-to-day operations. Examiners may also use it at small community banks, scaling their checks to each bank's size and risk. The OCC says the guide is not meant to set new expectations or enforceable standards for banks, and that banks are not expected to use it to judge themselves. The guide is not legally binding, but banks usually follow such guidance closely, according to a news report.
The OCC says it plans to update the guide regularly as the technology changes and as it hears from banks and others. It has not said what happens when an examiner finds a bank's checks too weak for a risky AI use.