On November 4, 2026, the Office of the Comptroller of the Currency (OCC) released a new supervisory framework for bank use of artificial intelligence.

The document gives bank examiners a way to evaluate how banks use AI in areas such as fraud detection, credit decisions, customer service, risk management, and compliance.

It is not a new regulation. The OCC specifically states that the framework does not create new requirements for banks, and banks are not expected to use it as a compliance checklist.

The framework addresses several practical questions about how AI should be used, tested, and controlled. Many of these are questions we have written about at Threat.Digital since early 2024, based on our experience building AI products for due diligence and financial crime compliance.

The risk depends on what the AI is allowed to do

The OCC makes a distinction between how advanced an AI system is and how much risk it creates. A more sophisticated model is not necessarily a higher-risk system. What matters is what the AI can do and what happens if it makes a mistake.

Consider two examples.

One system reads news articles, identifies possible financial crime risks, and prepares a summary with sources for an analyst to review.

Another system decides whether to clear a transaction monitoring alert without a person reviewing the decision.

Both might use the same underlying AI model. But the risks are different because the second system can directly affect a compliance decision.

The OCC includes an illustrative risk-tiering system in its framework. Agent-assisted research with required human review is an example of moderate risk. AML alert disposition is an example of higher risk. Systems that can move money or take other major financial actions on their own may carry even greater risk. Actual classifications depend on the details of each use case.

We wrote about this in February 2024 in Our AI Product Framework.

That policy established four principles for our AI development: choose technology based on the problem, keep people responsible for decisions, provide verifiable sources, and be clear about what AI can and cannot do.

We also made clear that our products were not intended to serve as sole decision-makers in matters affecting people.

In May 2025, we went further in Agentic AI Sounds Exciting, But Workflow AI Actually Gets the Job Done.

Our argument was that most AML and KYC work already follows defined procedures. Analysts review evidence, document findings, follow policies, and escalate issues when necessary. Giving an AI system the freedom to decide how to perform those tasks is not automatically an improvement.

AI can handle a great deal of work within a defined process. It does not need unlimited freedom to be effective.

That is how we approach DiligenAI. The platform researches companies and individuals, identifies relevant risk information, and organizes findings into reports with links to the underlying sources. Analysts can review the evidence and use it within their existing due diligence processes.

The OCC's framework discusses similar controls, including defined permissions, meaningful human review, and limits on what AI systems can do without approval.

Testing AI means testing the whole system

The framework also addresses a problem that has caused considerable confusion in financial services: how to validate AI systems.

Traditional AML models, such as transaction monitoring and customer risk scoring models, generally produce defined outputs that can be tested against expected results.

Large language models work differently. Their responses depend on the instructions, information, and tools provided to them. They can produce different answers to similar questions, and the underlying models are frequently updated.

In February 2026, we published These Are Not the AML Models You Are Used to Validating.

We explained why testing an AI model alone does not adequately test an AI-powered compliance product. You also need to understand the data it receives, the instructions it follows, the tools it can use, the decisions it can influence, and where people review its work.

On April 17, 2026, the OCC, Federal Reserve, and FDIC issued revised model risk management guidance that explicitly excludes generative and agentic AI models from its scope.

That does not mean AI systems are exempt from risk management. It means the traditional model risk management guidance does not cover these systems, and other risk management practices remain relevant.

The new OCC framework discusses approaches specifically suited to generative AI, including testing for inaccurate answers, evaluating unusual or malicious inputs, monitoring performance after deployment, and reviewing changes to models and workflows.

We discussed the practical side of this in August 2026 in AI Models Keep Changing. Due Diligence Technology Has to Change With Them.

At Threat.Digital, we use different large language models for different tasks, including adverse media analysis, entity identification, sanctions and watchlist result review, and risk classification.

A model that is good at deciding whether two companies with similar names are the same entity may not be the best choice for extracting risk categories from a news article.

We built an internal model comparison system to test models against the actual due diligence tasks our products perform. Depending on the task, we compare accuracy, consistency, reasoning quality, speed, and cost.

This allows us to evaluate new models against those already in use. Sometimes a newer model performs better. Sometimes a smaller, less expensive model produces equally good results. Sometimes an update offers no meaningful improvement.

We do not assume that a new model is better simply because it is new.

The OCC's framework addresses this same problem. A model change, even one made by an outside provider, can affect how a system behaves. Testing and monitoring need to account for those changes.

What banks should ask AI vendors

The OCC also devotes a section of the framework to third-party AI providers.

Most financial institutions are not building their own large language models. They are purchasing software that uses models developed by other companies. That creates questions about data security, accuracy, model changes, and who is responsible when something goes wrong.

We wrote about this in March 2025 in Navigating Vendor Onboarding with an 'AI' Product.

By then, we had been through vendor onboarding at several dozen organizations. We found that AI-related reviews were adding an average of one to two months to the process.

Some organizations asked focused questions about how the technology worked and where the risks were. Others applied extensive review procedures to anything labeled AI, even when the system had limited authority and humans remained responsible for decisions.

The new OCC framework gives banks and vendors more detail to work with when discussing those risks.

For financial institutions evaluating an AI product, five questions are particularly useful:

1. What is the AI allowed to do? Does it prepare information for someone to review, or can it make decisions and take actions on its own?
2. Can its results be checked? Can users see the underlying sources, review the evidence, and correct mistakes?
3. How is the system tested? Does the vendor test the complete workflow, including what happens when AI produces incorrect or misleading information?
4. What happens when the AI changes? How does the vendor evaluate new models, updates, and changes to the instructions or tools the system uses?
5. What happens to customer data? Which companies process it, how long is it kept, and can it be used to train AI models?

The answers should depend on what the product actually does. An AI tool that helps someone summarize a document does not present the same risks as a system authorized to move funds or make final compliance decisions.

At Threat.Digital, these questions have been part of our work for years.

We first published our AI product principles in February 2024. Since then, we have written about workflow design, vendor reviews, model validation, and the need to keep evaluating AI as the technology changes.

These articles came from the work of building and maintaining DiligenAI, testing models against real due diligence tasks, and supporting customers using AI in compliance and research workflows.

The OCC's new framework addresses many of the same issues. It does not endorse any particular technology or vendor. But it gives bank examiners a more specific way to look at what AI systems do, how they are controlled, and how institutions can evaluate the risks.

Those are the questions that have shaped our approach to DiligenAI since we first put our AI product principles in writing in 2024.