On November 4, 2026, the Office of the Comptroller of the Currency gave its bank examiners a supervisory framework for evaluating the generative and agentic systems that national banks now run. The OCC uses the term super intelligence, or SI, following a recent executive order that directs federal agencies to use it in place of AI, and the framework defines SI as the same technologies the law calls artificial intelligence. Its section on human oversight carries a line that reaches well past banking: review triggers, evidence, and procedures may be defined “so that approval is more than a nominal click.”
The OCC is careful about what this document is and isn’t. The bulletin that released it says it “does not establish supervisory expectations for banks” and sets no enforceable standards, and it describes the framework as a resource for examiners, who are told to tailor their work to how material each use case is. It also fills a gap. In April, the OCC, the Federal Reserve, and the FDIC revised their model risk management guidance and left generative and agentic AI models outside its scope because they are “novel and rapidly evolving.” The new framework says it is more applicable to exactly those systems.
What examiners can ask about the human reviewer
The framework groups sixteen components into six pillars, and the human oversight component is the one that asks whether a reviewer can actually intervene. Human-in-the-loop, in the OCC’s words, “generally refers to review and approval before an output or action is used or executed,” while human-on-the-loop refers to “active monitoring with authority and practical ability to intervene.” The considerations that follow test whether either label is real. The assigned reviewer may need “sufficient expertise, information, and authority to evaluate, reject, modify, pause, or halt the system’s output or action.”
High volumes or bulk approval “could reduce review quality and contribute to alert fatigue,” so a bank may evaluate how many agents, accounts, alerts, or actions one person can credibly monitor and how much time that person has to intervene. Override authority, reasons, and patterns may be logged and reviewed, and where appropriate the reviewer may sit apart from the team that built or owns the system. The summary table that follows the sixteen components compresses the whole concern into one risk: “A named human reviewer without practical authority, competency, capacity, or a meaningful review standard.” That puts a reviewer in name only on a federal bank regulator’s list of risks.
Oversight is an input to the risk tier
The framework’s overarching principle ties control intensity to consequence, and it says risk classification “may be based on potential consequences, transfer of agency, and the degree of human oversight, rather than the technical sophistication of the SI used.” Its own example makes the point: a simple rules-based agent authorized to initiate transactions could present greater risk than a sophisticated model limited to internal drafting. In the illustrative tiers, a fully autonomous, customer-facing payment agent sits at Tier 1 “regardless of how well it performs in testing,” while decision support with mandatory human-in-the-loop review sits at Tier 3.
Human oversight is one of the inputs the framework says may set the rating, alongside reversibility, data sensitivity, and the other factors in the composite tier. A bank that claims mandatory human-in-the-loop review still has to show it works, since the framework says human oversight is most effective when the bank “can demonstrate that the control operates as intended.” An examiner can reasonably ask how often the answer was no, who gave it, and what that person saw before deciding.
Two kinds of checking in one document
Much of the framework describes automated controls. Control agents, deterministic rules, circuit breakers, rate limits, and kill switches can help contain an agent “that is operating but acting incorrectly.” One model may also judge another’s outputs, and the bank may weigh the judge model’s validation, independence, bias, and correlated failure modes along with “the need for human review.” All of it falls under Responsible AI, where one machine checks another and nobody with authority decides on the individual output. It does real work, and the framework says audit may assess whether each backstop is independently governed, tested, and effective.
The human oversight component describes something different. Basil Puglisi’s Checkpoint-Based Governance page draws a similar line: “Someone approving outputs faster than they can read them is in the loop,” it says, and after listing other kinds of presence, “None of them is a governor.” AI Governance in CBG terms means a named human holds the authority to accept, modify, or reject at a defined checkpoint, and the record shows which of the three that person chose. The OCC’s reviewer who can “evaluate, reject, modify, pause, or halt” comes close to that standard, and the warning about bulk approval names how it slips. The paper Human-AI Collaboration Needs More Than a Human in the Loop states the slip directly: “Any reduction in substantive human engagement at a checkpoint converts AI Governance back into Responsible AI, regardless of physical human presence.”
What a bank, or any deployer, can write down now
The framework is written for examiners, but the evidence it describes can only come from the organization running the system. For each use case that claims human-in-the-loop review, a deployer can name the reviewer, state what that person sees before approving, and record whether each item was accepted, modified, or rejected. It can track the share of items the reviewer changed or stopped and the number of items each reviewer handles per hour. A share near zero while volume climbs doesn’t prove the reviews are shallow, but it’s the pattern that calls for a closer look at reviewer capacity and at the tier that review supports.
Some systems move too fast for review of each item, and for those the CBG approach is that a named human signs the policy authorizing the automated action and answers for it, which means writing down who signed, what the policy allows, and when it comes back for review.
On November 4 the OCC gave examiners a way to tell a reviewer with authority apart from a name on an approval screen. Any organization with a human approval step can run that same test on itself today, starting with its own override log and the record of what each reviewer saw.
Sources
- Executive Office of the President. (2026, October 2). Inaugurating the era of super intelligence (Executive Order 14434). Federal Register, 91, 63129. https://www.federalregister.gov/documents/2026/10/02/2026-20321/inaugurating-the-era-of-super-intelligence
- Office of the Comptroller of the Currency. (2026, April 17). Model risk management: Revised guidance (OCC Bulletin 2026-13). https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-13.html
- Office of the Comptroller of the Currency. (2026, November 4). OCC issues supervisory framework on bank use of super intelligence (News Release 2026-97) [Press release]. https://www.occ.gov/news-issuances/news-releases/2026/nr-occ-2026-97.html
- Office of the Comptroller of the Currency. (2026, November 4). OCC supervisory framework for bank use of super intelligence. https://www.occ.gov/news-issuances/news-releases/2026/nr-occ-2026-97a.pdf
- Office of the Comptroller of the Currency. (2026, November 4). Super intelligence: Supervisory framework (OCC Bulletin 2026-54). https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-54.html
FAQ
What did the OCC issue on November 4, 2026?
The Office of the Comptroller of the Currency released OCC Bulletin 2026-54, Super Intelligence: Supervisory Framework, with a supervisory framework that helps bank examiners evaluate how national banks, federal savings associations, and federal branches use super intelligence, the term the OCC now uses, following a 2026 executive order, for technologies previously called artificial intelligence. The framework groups sixteen components into six pillars: purpose, risk, control, oversight, resilience, and assurance.
Does the framework create new requirements for banks?
No. The bulletin says the framework does not establish supervisory expectations for banks and sets no enforceable standards or prescriptive requirements. It is a resource for examiners, who are told to tailor their work to the materiality of each use case, and the OCC intends to update the guide as the technology and supervisory understanding mature.
What does the framework say about human-in-the-loop review?
It defines human-in-the-loop as review and approval before an output or action is used, and human-on-the-loop as active monitoring with authority and practical ability to intervene. It says the reviewer may need the expertise, information, and authority to evaluate, reject, modify, pause, or halt the output, that review may be defined so approval is more than a nominal click, and that high volumes or bulk approval could reduce review quality.
How does human oversight affect a use case’s risk tier?
The framework says risk classification may be based on potential consequences, transfer of agency, and the degree of human oversight rather than technical sophistication. In its illustrative tiers, a fully autonomous, customer-facing payment agent is Tier 1, and decision support with mandatory human-in-the-loop review is Tier 3.
Why does the OCC use the term super intelligence instead of AI?
A 2026 executive order directed federal agencies to use super intelligence and SI in place of artificial intelligence and AI in their own documents. The OCC framework defines super intelligence as the technologies previously encompassed by the statutory definition of artificial intelligence, so the guidance applies to the same systems.
What can a bank or other deployer do now?
Name the reviewer for every use case that claims human-in-the-loop review, record what that person sees and whether each item was accepted, modified, or rejected, and track how often the reviewer changes or stops an item and how many items each reviewer handles. For systems too fast for item-by-item review, have a named person sign the policy that authorizes the automated action and set a date to review it.
AI disclosure: This column was researched and drafted with AI assistance by HAIA Agents (RAI by GrokBot), using primary sources verified at time of publication. #AIgenerated
Leave a Reply