Purpose
State what the system may do, what it must not do, what data it can use and when a person must review or stop it.
Safe use of AI in data driven risk management
Model and AI Risk
The OCC’s new examiner framework adds practical questions about how AI is used, who controls it and how the institution responds when it fails. These questions matter wherever data or AI helps teams assess risk, monitor activity or decide what to review next. Complaints are one example, not the limit.
The use matters
Look at the system and the work around it.
A model is only one part of a business process. Data, software, staff, vendors and connected tools can all affect the result. A system that only helps a person review records has a different risk from one that ranks cases, sends notices or takes action on its own.
The OCC framework asks examiners to consider the likely consequences, the system’s autonomy and the strength of human oversight. Technical complexity alone does not set the risk.
OCC examiner framework
Six areas to make visible.
Use these as questions for a specific system and workflow. Set the depth of review to the use and its possible effects.
Risk
Scale review to likely harm, reversibility, data sensitivity, autonomy and the decisions the output may shape.
Control
Set checks for data, privacy, security, compliance and model use. Test how the whole workflow behaves.
Oversight
Name the owner and reviewers. Give them the skill, time, evidence and authority to challenge the output.
Resilience
Decide how to detect a failure, pause use, fall back to a safe process and recover without losing key work.
Assurance
Keep records of versions, inputs, results, changes, exceptions and human decisions. Arrange independent challenge where it fits the risk.
Across financial services
Apply the questions beyond one data source.
The same control questions arise in different teams and tools.
Risk assessments
Can a reviewer trace a finding to the records, assumptions and duties that support it? Are limits and other explanations clear?
Monitoring and investigations
What activity is covered? How are alerts ranked or set aside? Can a reviewer see why a result changed after a rule, model or data update?
Controls and process change
Do system outputs fit the approved process? Can the team find handoff failures, test a fix and show what evidence supports closure?
Complaints and service data
Can the institution spot a new pattern, check the source evidence and connect a confirmed process issue to an owner and action?
FairBorrow™.Ai approach
Connect data, risk and action.
FairBorrow™.Ai brings software-led thought leadership together with practical risk and compliance work. The focus is on making findings clear enough to test, showing what is known and what is still uncertain, and helping teams decide what needs attention.
Work can include risk oversight, AML/BSA, policies and controls, complaints analysis, operations and audit. Each use needs a clear scope, suitable data controls, review roles and evidence that fits the decision at hand.
QUESTIONS FOR LEADERS
- What is the system allowed to influence?
- What data and outside services does it rely on?
- Can the team find missed cases and changes in behavior?
- Who can pause use and approve the next step?
- Can another reviewer rebuild the decision from the records?
TWO PAGE DISCUSSION · BY PRAFUL MAINKER
What the OCC framework adds to model risk management
A closer look at how the examiner framework applies to AI-supported complaint intelligence. It is one example within this broader discussion.
Guidance and limits
The OCC’s November 2026 framework is a resource for examiners. It does not set new requirements for banks. The revised interagency MRM guidance is supervisory guidance, not an enforceable standard. It covers traditional models and non-generative, non-agentic AI models. It does not cover generative or agentic AI. Banks still need governance and controls suited to tools outside its scope.
- OCC Bulletin 2026-54, Super Intelligence: Supervisory Framework
- OCC Bulletin 2026-13, Model Risk Management: Revised Guidance
- Federal Reserve SR 26-2, Revised Guidance on Model Risk Management
This material supports discussion. It is not legal advice, a model validation or a regulator’s view of a specific institution. Agree the scope and roles before starting an engagement.
A useful first conversation
Discuss a model or AI risk question.
Share the business question, the type of system and what you need to decide. Please do not send customer records or confidential information in your first message.