On November 4, the Office of the Comptroller of the Currency (OCC) issued a new supervisory framework describing how examiners should evaluate banks’ use of “Super Intelligence” (SI), the term the publication uses for technologies previously encompassed by artificial intelligence. The framework addresses SI used in areas including credit decisioning, payments, fraud detection, customer service, operations, risk management and market activities, with particular focus on generative and agentic systems. The OCC emphasizes that SI is not a separate risk category. Rather, its risks should be identified, measured, monitored and controlled within banks’ existing risk management frameworks.

Proportionality as the Central Principle

A central principle of the framework is proportionality: the greater the potential consequences of an SI system’s failure or misuse, the stronger its controls may need to be. The OCC explains that risk should turn on factors such as the consequences of failure, the degree of autonomy or “transfer of agency,” and the extent of human oversight, rather than simply the technological sophistication of a system. Thus, a relatively simple system authorized to initiate transactions may present greater risk than a sophisticated model used only to help employees draft internal materials.

Six Pillars and Sixteen Supervisory Components

The framework organizes 16 supervisory components around six pillars: purpose, risk, control, oversight, resilience and assurance. Among other things, banks may consider clearly defining permitted uses; classifying use cases based on consequences and criticality; establishing meaningful human oversight; addressing data governance, privacy and cybersecurity; managing third-party risk; continuously monitoring performance; and maintaining sufficient testing, documentation and independent challenge. The OCC also highlights risks specific to generative and agentic technology, including hallucinations, prompt injection, model and data poisoning, scope drift, and systems that remain operational while nevertheless taking inappropriate actions.

Consumer-Facing Uses

For consumer-facing uses, the framework makes clear that SI does not alter banks’ existing legal obligations. The OCC notes that systems used in customer service, marketing, servicing, collections, disclosures and other consumer-facing activities can create compliance risk when their outputs are materially inaccurate, misleading or inconsistent with product terms. In particular, hallucinations involving fees, rates, account status or policies could create legal and customer-harm exposure, potentially warranting controls such as verification of higher-impact outputs and procedures for correction and remediation.

Four-Tier Methodology for Calibrating Controls

The OCC also provides an illustrative four-tier methodology for calibrating controls to SI use cases. Tier 1, or “Critical,” includes potentially high-impact uses such as autonomous payment agents and real-time credit decisioning. Tier 2, or “High,” includes SI-assisted underwriting and agent-initiated customer communications. By contrast, internal document summarization with required human review is identified as a Tier 3, “Moderate,” example, while fully human-controlled internal productivity tools with no customer or financial data exposure may fall within Tier 4, “Low.” Factors informing the classification include decision consequences, reversibility, customer and financial impact, autonomy, data sensitivity, explainability and provenance.

Next Steps

The publication signals that OCC examinations of SI will build on familiar risk-management principles while focusing increasingly on the particular risks created by autonomous and rapidly evolving systems. Importantly, the OCC describes the framework as a “living document” that it expects to update as the technology, bank use cases and supervisory understanding evolve. For banks deploying or considering generative or agentic systems, the framework provides a useful roadmap for evaluating whether controls and human oversight are appropriately calibrated to what a SI system is actually permitted to do and the consequences if it gets it wrong.