The framework creates no binding obligations. The bulletin states that it does not establish supervisory expectations or enforceable standards, and it does not create new regulatory expectations. Examiners should not treat AI as a separate risk category, and banks do not need a standalone AI risk appetite. The framework also treats vendor reliance as a source of model, data, legal, concentration, and resilience risk that standard service-level and security reviews do not fully cover. A follow-up is still pending. The agencies plan to issue a request for information on model risk management generally, with a specific look at AI, but have not set a date. The OCC has also said it will update the framework regularly.
The framework fills a gap left by OCC Bulletin 2026-13, the April 2026 revised interagency model risk guidance, which explicitly excluded generative and agentic AI from its scope. It is the first OCC-specific supervisory guide for agentic AI. Attorneys should expect it to shape vendor contracts and fintech partnerships, because it ties the level of control a bank must apply to what an AI tool can do without human direction. Watch for the forthcoming request for information and for revisions to the framework.