The US Office of the Comptroller of the Currency (OCC), which supervises national banks, issued Bulletin 2026-54 on 4 November 2026: a framework its examiners will use to assess how banks use artificial intelligence, including AI agents that act on their own.
Key points
- The framework sets out 16 components grouped into six pillars, with an illustrative scale of four risk tiers.
- A system’s tier depends on what happens if it fails and how much it can do on its own, not on how sophisticated it is. Autonomous payment agents sit in the highest tier, however well they perform in testing.
- Examiners may also check whether a bank can identify outside AI agents using its channels and limit what they can do.
- The OCC says the framework is for examiners only: it sets no new requirements for banks, and banks are not expected to use it to assess themselves.
The bulletin applies to US national banks, federal savings associations, and federal branches of foreign banks, but the thinking behind it is useful for any organisation using AI agents. Keep an inventory of AI systems, rate each one by the harm a failure could cause and how independently it acts, and make sure high-impact agents have human oversight, clear permissions, and a way to stop them (ISO/IEC 42001 sets out a management system for this).
Source: Forvis Mazars summary of OCC Bulletin 2026-54
This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.
