Artificial intelligence can draft a borrower email, flag a servicing issue, or recommend a change to a loan file. But what happens when the technology is authorized to act on those recommendations without someone approving each step?
A new supervisory framework released Nov. 4 by the Office of the Comptroller of the Currency (OCC), offering mortgage companies a useful way to evaluate the risks emerging as AI moves beyond assisting employees and begins executing tasks.
The OCC's Bulletin 2026-54 introduces a supervisory framework for what the agency calls "super intelligence," or SI, a term encompassing technologies previously described as artificial intelligence.
The framework is intended to help OCC examiners evaluate how banks manage risks associated with increasingly capable and autonomous systems.
Importantly, it does not establish new regulatory requirements. The OCC states that banks are not expected to use the document to assess their AI programs, and that it does not impose enforceable standards or prescriptive obligations.
The guidance offers a window into how federal bank examiners are approaching the consequences of AI use, particularly when systems are permitted to act independently.
The Difference Between Recommending and Acting
James W. Brody, founder and managing partner of Brody Gapp LLP and a mortgage banking attorney focused on AI governance, highlighted the distinction in a recent analysis.
"A reasonable output does not establish that an action was authorized," Brody said.
A system might correctly identify a servicing adjustment, for example, but that does not necessarily mean it has permission to make the change.
Brody pointed to the different risks associated with an AI system drafting a borrower communication versus sending it, modifying a servicing record, or initiating a payment.
The issue extends beyond whether an AI tool produces reliable information. Companies also need to understand what permissions the technology has, which decisions require human approval, and how an unauthorized action would be detected.
An AI assistant reviewing borrower documents presents a different operational exposure from an autonomous agent that updates information in a loan origination system or communicates directly with borrowers.
The OCC framework addresses the potential consequences of AI actions, the degree of system autonomy, the availability of human oversight, and whether mistakes can be reversed.
Human Oversight Has To Work In Practice
The framework also examines the effectiveness of human supervision.
A company may have a policy requiring employee review of AI-generated decisions, but that control depends on whether employees have the information, expertise, time, and authority needed to intervene.
Brody emphasized that human oversight must function at the speed of the technology being supervised.
That raises practical considerations when AI systems process large volumes of documents, borrower inquiries, or servicing requests.
A reviewer assigned to oversee hundreds of automated actions may have limited ability to identify a problem before it affects a borrower or enters the company's system of record.
The framework's emphasis on oversight capacity suggests that the effectiveness of a control matters more than simply documenting that a person is responsible for it.
When an AI System Keeps Running But Gets It Wrong
Another concern is how companies respond when an AI system operates normally from a technical standpoint but produces incorrect or potentially harmful results.
A borrower-facing agent, for example, could remain available around the clock while repeatedly providing incorrect payment instructions.
Traditional technology monitoring might show that the system is functioning normally, even as the errors continue.
The OCC framework addresses containment, fallback procedures, recovery, and remediation, recognizing that stopping a malfunctioning system may not resolve the consequences of actions it has already taken.
For servicers, that could mean identifying affected borrower accounts, reviewing communications, correcting records, and determining whether additional remediation is necessary.
The concern becomes more significant as AI agents gain access to systems that can execute transactions or change customer information.
Vendor Updates Can Change The Risk
The framework also highlights risks associated with third-party technology.
A mortgage company may approve an AI-enabled platform for a limited purpose, only to discover that a subsequent software update introduces new autonomous capabilities or expands the system's access to borrower information.
Brody warned that changes in vendor functionality can alter a company's exposure even when the underlying technology provider remains the same.
That creates an ongoing oversight issue for lenders relying on outside platforms for document processing, underwriting support, borrower communications, and servicing.
Companies evaluating these tools may need to look beyond initial vendor approval and examine how new features, permissions, and automated workflows are reviewed before deployment.
Contractual responsibility for errors and customer harm is another consideration, particularly when a vendor's system can take actions affecting borrowers.
How This Fits With Existing Mortgage AI Requirements
The OCC framework differs from the AI governance obligations already established by Fannie Mae and Freddie Mac.
The government-sponsored enterprises have incorporated AI oversight requirements into their seller/servicer frameworks, creating contractual obligations for covered institutions.
Unlike the OCC's examiner resource, those requirements directly affect mortgage companies subject to the applicable GSE agreements.
The distinction is important because nonbank mortgage lenders and brokers are not directly subject to OCC supervision simply because they use AI. Their obligations depend on applicable laws, regulatory requirements, and contractual commitments.
The mortgage industry has also developed voluntary resources for managing AI risks.
MISMO has introduced its Framework for Responsible AI in the Mortgage Ecosystem, known as FRAME, to help companies assess AI governance practices and technology risks.
A Practical Test For Mortgage Companies
For lenders and servicers already deploying AI, Brody recommends examining one consequential use case before expanding the technology's authority.
"My recommendation: take one consequential AI use and trace its permissions, human checkpoints, executed actions, and recovery process," he said.
That exercise could be particularly useful for companies moving from AI-assisted document review or customer support toward autonomous loan processing and servicing functions.
It also provides a practical starting point for evaluating third-party systems. A lender should be able to determine what an AI agent can access, which actions require approval, and how the company would identify affected borrowers or transactions if something goes wrong.
The OCC's framework makes clear why evaluating an AI system's accuracy is only part of the oversight challenge.
