What's Happening?
The Office of the Comptroller of the Currency (OCC) has released a new supervisory framework, Bulletin 2026-54, for what it terms "super intelligence" (SI) in the mortgage industry. This framework aims
to help OCC examiners evaluate how banks manage risks associated with increasingly capable and autonomous AI systems. The guidance focuses on the distinction between AI systems recommending actions and independently executing them. James W. Brody, a mortgage banking attorney, highlighted that a reasonable AI output does not automatically authorize an action. The framework addresses the potential consequences of AI actions, the degree of system autonomy, the availability of human oversight, and the reversibility of mistakes. It also scrutinizes the effectiveness of human supervision, questioning whether employees possess the necessary information, expertise, time, and authority to intervene when AI systems process large volumes of documents or requests. The OCC framework does not establish new regulatory requirements or impose enforceable standards on banks, but rather serves as a resource for examiners.
Why It's Important?
This OCC framework is significant for the U.S. mortgage industry as it signals how federal bank examiners will approach the risks of AI, particularly when these systems operate autonomously. While not creating new regulations, it provides a lens through which banks' AI implementations will be scrutinized, potentially influencing their adoption and deployment strategies. The emphasis on effective human oversight means that companies cannot simply have policies in place; they must ensure their human staff are adequately equipped to manage and intervene with AI systems. This could lead to increased investment in training and the development of robust internal controls. For mortgage companies, understanding this framework is crucial for mitigating operational and reputational risks, especially as AI moves beyond assistive roles to independent task execution. The framework also highlights the complexities of vendor-supplied AI, where updates can introduce new risks, necessitating ongoing oversight from lenders.
What's Next?
Mortgage companies, particularly those deploying or considering autonomous AI systems, will need to review their current AI governance practices in light of the OCC's framework. James W. Brody recommends that lenders and servicers examine one consequential AI use case to trace its permissions, human checkpoints, executed actions, and recovery processes. This exercise will be particularly valuable for companies transitioning from AI-assisted functions to autonomous loan processing and servicing. Furthermore, companies will need to enhance their due diligence and ongoing monitoring of third-party AI vendors to assess how new features and permissions might alter their risk exposure. The distinction between the OCC's framework and existing GSE requirements from Fannie Mae and Freddie Mac means that nonbank mortgage lenders and brokers will need to consider their obligations based on applicable laws, regulatory requirements, and contractual commitments, in addition to this new guidance.
Beyond the Headlines
The OCC's framework delves into the deeper implications of AI autonomy, particularly the challenge of managing systems that operate normally from a technical standpoint but produce incorrect or harmful results. This raises critical questions about accountability and remediation when AI systems make errors, especially if those errors affect borrowers or financial records. The framework's focus on containment, fallback procedures, and recovery underscores the need for robust incident response plans that go beyond simply stopping a malfunctioning system. It also highlights the ethical dimension of AI, where the speed and volume of AI operations can overwhelm human oversight, potentially leading to widespread, uncorrected issues. The guidance implicitly encourages a shift in thinking from merely validating AI accuracy to comprehensively understanding its operational permissions, potential for unauthorized actions, and the mechanisms for detecting and reversing mistakes, thereby shaping a more responsible approach to AI integration in critical financial services.
