Enabling with AIThe latest strategies for AI enablement in your business
Last updated Nov 14, 2026Written and edited by Ali PeivandizadehNo ads. No sponsors.
AI at Work · Action

Rank your AI uses in four levels by what can go wrong

By Ali Peivandizadeh, business growth and AI implementation specialist.

Published Nov 14, 2026 · Last checked Nov 14, 2026 · Last changed Nov 14, 2026
The short answer

A US bank regulator published the framework its examiners use to review AI. It ranks each AI use by what can go wrong, and not by how advanced the tool is. Any business can make the same one-page list in an afternoon.

Verdict
ACT
For
Any business that uses AI in more than one place. 10 employees and up. Owner or operations lead.
Cost and time
No cost. About one afternoon for the first list.

Why

The Office of the Comptroller of the Currency supervises national banks. It published the framework on Nov 4, 2026, as a guide for its examiners. It applies to banks only. The method works for any business, because it starts from consequences. A law firm's summary describes four levels. Level 4, low, is an internal tool that sees no personal or financial data and takes no action. Level 3, moderate, supports a decision that a person must review. Level 2, high, takes part in an important decision or contacts customers, with a person monitoring it. Level 1, critical, acts on its own, and the action is hard to undo.

What to do

  1. List every place AI is used in the business. Include tools staff use on their own and AI features inside software you already pay for.
  2. For each use, write three things: what it is allowed to do, what data it sees, and who oversees it.
  3. Give each use a level from 4 (low) to 1 (critical).
  4. For levels 1 and 2, name the person who can stop the tool. Test that the stop works.
  5. Ask each software vendor in writing whether it added AI to its product this year.
  6. Check what AI tells customers about a price, a date or a promise. A person or a fixed, approved text should stand behind each answer.
  7. Keep the list on one page. Update it every quarter.

What data may go in

The list itself holds no customer data. For each tool on it, write what data the tool sees.

Who checks the output

The owner or the operations lead owns the list. Each tool on it has one named person who oversees it.

The rule to check

The framework is written for bank examiners and is not a rule for other businesses. Your own industry may have its own AI rules, and some states require notice when AI is used with customers.

What can go wrong

A vendor can add AI to a product you already use and not tell you, and the list is then out of date. The framework also says that a reviewer who only clicks a button is not oversight. The reviewer needs the knowledge, the time and the authority to reject an output or stop the tool.

Sources

Plain text version