Footnote 3 of the framework the Office of the Comptroller of the Currency issued on 4 November 2026 contains a disclosure that few supervisory documents have carried. Citing Executive Order 14434, it says that "this framework was prepared with the assistance of SI," and adds: "The content has been reviewed, edited, and approved by a human." The footnote discloses neither the production workflow nor the data the tool could reach. Read against the framework's own table, the use it describes resembles a low-tier one: internal drafting, no direct action on customers or funds, and a human who reviewed and approved the finished text. That small example points to the document's central idea, which is that the risk of an AI system depends on what it is allowed to do and who can stop it.
The framework is the attachment to OCC Bulletin 2026-54, "Super Intelligence: Supervisory Framework," signed by James M. Gallagher, Senior Deputy Comptroller and Chief National Bank Examiner. This post sets the bulletin's statements about its own legal force beside what the 22-page framework actually asks examiners to look for.
Practical takeaway. The OCC says Bulletin 2026-54 creates no new expectations for banks, and that is accurate as a statement of legal force. In Quentir's reading, the text still shows what OCC examiners may ask where they choose to apply it, tailored to each bank. A bank that runs AI agents with authority to move funds, release fraud holds or change customer records should expect, on the framework's illustrations, that those uses could be read as Tier 1 or Tier 2, with possible questions about purpose boundaries, reviewer capacity, agent credentials, kill switches and contract liability.
What the OCC issued on 4 November 2026, to whom, and under which definition
The OCC's news release 2026-97 describes the document as a framework "for its bank examination workforce on banks' use of Super Intelligence." The bulletin is addressed to the chief executive officers of all national banks, federal savings associations and federal branches and agencies of foreign banking organizations, to OCC department and division heads, to all examining personnel and to other interested parties. A note for community banks says examiners may use the framework there too, tailored to the bank's size, complexity and risk profile.
The vocabulary comes from the White House. Footnote 2 defines "Super Intelligence" as the technologies "previously encompassed by the term 'Artificial Intelligence'" in 15 U.S.C. 9401(3), together with their "rapidly advancing capabilities," and cites Executive Order 14434 at 91 Fed. Reg. 63129. Quentir's reading of Executive Order 14434 explained that the order changed federal wording while leaving the statutory meaning of AI in place. Bulletin 2026-54 applies the new term to bank supervision and keeps the statutory scope. Footnote 1 adds a boundary: the model risk management principles in OCC Bulletin 2026-13 apply to non-generative and non-agentic models, so the new framework is "more applicable to generative and agentic SI."
What Bulletin 2026-54 says about its own legal force
The bulletin is explicit. "This supervisory framework does not establish supervisory expectations for banks." Banks "are not expected to use this document to assess their use of SI or their SI risk management," and nothing in it "is intended to establish new regulatory expectations or set forth enforceable standards or prescriptive requirements." Examiners "should not treat SI as a separate and distinct risk category," and banks "are not required to define a separate SI risk appetite." The risks SI introduces or amplifies are to be handled inside existing categories such as operational, compliance and credit risk. The OCC says it will update the framework regularly and calls it a living document.
The verbs follow the same line. Almost every consideration in the 16 components is phrased with "may" or "could." Only one sentence makes "the bank" the subject of "should," in the third-party component: "The bank should consider how contracts assign responsibility for model related errors or losses including customer harm," with indemnification, caps and loss responsibility listed as the terms in play. In a document that otherwise describes options, that sentence concerns who pays when an AI vendor's model causes a loss.
Which controls the 16 components still describe in detail
Legal force and practical weight are separate questions. An examiner's guide shows a bank what examiners may ask when they use it, and this one is specific. The purpose component says authorized data sources, tools, accounts and actions "may be stated in terms that can be tested rather than as a general capability description," and that activity outside the approved purpose "may be treated as a control failure even when the resulting output or action appears reasonable." That last clause treats scope drift as a failure in itself, whatever its outcome.
The human-oversight component asks whether approval is "more than a nominal click," notes that bulk approval can cause alert fatigue, and invites a bank to evaluate "how many agents, accounts, processes, alerts, or actions one person can credibly monitor." The operational-resilience component recognizes a failure mode that classic continuity planning does not cover: an agentic system "could remain available while taking inappropriate or harmful actions." Its listed tools include control agents, circuit breakers, rate limits, least-privilege permissions and kill switches, together with a separate customer-remediation workstream when a misfire reaches customers. The cybersecurity component asks that agent identities and credentials be governed "in a manner comparable to privileged users," which places non-human identities inside the bank's privileged-access controls. Testing covers adversarial inputs, red teaming and the use of one model to judge another, with attention to the judge model's own biases and correlated failures.
How the four illustrative risk tiers sort a payment agent from a drafting tool
Section 3 sets out the scoring. Each use case is rated on seven factors, independent of business line: decision consequence, reversibility, customer and financial impact, autonomy level, data sensitivity, explainability and provenance. The aim is that "a comparable risk gets a comparable control regardless of where it originates in the bank." The factors combine into a composite tier.
Tier 1, Critical, covers direct action with low or no reversibility, high financial or customer impact and full or partial autonomy; the examples are an autonomous payment agent, real-time credit decisioning, fraud-hold release and market access. Tier 2, High, covers SI-assisted underwriting, agent-initiated customer communications, anti-money-laundering alert disposition and code assistance that changes internal code or data access. Tier 3, Moderate, covers decision support with mandatory human review, such as summarizing documents for credit memos. Tier 4, Low, requires no customer or financial data exposure, no direct action and fully human-controlled use, and its examples are internal productivity tools, code assistance and general employee questions. The overarching principle states the logic in one example: "a simple rules-based agent authorized to initiate transactions could present greater risk than a sophisticated model limited to internal drafting assistance." Consequence, reversibility and the permissions an agent holds weigh more in the tier than technical sophistication.
How Quentir Reads It
Quentir reads Bulletin 2026-54 as a detailed statement by a US federal bank regulator about AI agents, and its disclaimer as accurate on legal force. Our inference is that its practical effect will be larger than that disclaimer suggests: examiners who use a 16-component framework in a bank are likely to draw on its questions, and any concerns would be expressed in the language of existing safety-and-soundness categories. The instrument type is the clearest point of comparison with Singapore. The Monetary Authority of Singapore's Guidelines on AI Risk Management of 7 October 2026 are supervisory expectations for institutions, phrased with "should," with the first sections taking effect on 7 October 2027; they also fit into existing risk frameworks, expect AI risks to be addressed within the institution's risk appetite framework, and allow basic policies only where AI failure is unlikely to have a material adverse impact. The OCC text is a set of illustrative considerations for examiners that states it sets no expectations for banks. Both regulators arrive at the same practical tools for agents: inventories, impact ratings and the ability to stop a running system.
The first open question is enforcement. Because the bulletin creates no standard, any supervisory finding about an agent will have to rest on existing law and safety-and-soundness principles, and the first public enforcement action that cites an AI agent's failure will show how far examiners lean on this text. The second is the bank-vendor contract. The one sentence that tells "the bank" what it should consider concerns liability for model errors. Much of that allocation will be written into contracts between banks and AI providers, and disputes those contracts leave open may still reach courts. Quentir's coverage of Executive Order 14434, the MAS guidelines and the wider supervision of AI in finance is available in one subscription through the All-access membership, which opens the full archive this analysis draws on.
Sources: Office of the Comptroller of the Currency, OCC Bulletin 2026-54, "Super Intelligence: Supervisory Framework", 4 November 2026, signed by James M. Gallagher, Senior Deputy Comptroller and Chief National Bank Examiner; Office of the Comptroller of the Currency, Supervisory Framework on Bank Use of Super Intelligence (PDF, sections 1.1, 1.2, 2.1 to 2.16, 3.1, 3.2, Appendix A and footnotes 1 to 3); Office of the Comptroller of the Currency, News Release 2026-97, "OCC Issues Supervisory Framework on Bank Use of Super Intelligence", 4 November 2026; Executive Order 14434, 91 Fed. Reg. 63129 (2 October 2026); 15 U.S.C. 9401(3); Monetary Authority of Singapore, Guidelines on Artificial Intelligence Risk Management, 7 October 2026. Links checked 6 November 2026.
Published intelligence, built to inform your own decisions. Published: November 6, 2026.