Supervisors on both sides of the Atlantic now expect banks to inventory their AI and tier it by risk. Neither says which controls each system needs. Machine learning, generative and agentic AI overlap, so most inventories put a credit model, a chatbot and a rules engine in the same bucket and give them the same controls. We sort your inventory by what each system outputs, tier it by the consequence of failure, assign each one the controls it needs, and show you the gaps against SS1/23, the FCA’s October 2026 review and the OCC’s November 2026 AI framework.
In the UK, the FCA’s review of AI in financial services (19 October 2026) points to an inventory of AI use cases and the models behind them, and to risk scoring or tiering to calibrate governance — but leaves the method to each firm. Its own terms — machine learning, generative AI, agentic AI — overlap, so they cannot serve as a classification. In the US, OCC Bulletin 2026-54 (4 November 2026) gives examiners a framework for all AI — including the generative and agentic AI that the April model risk guidance left out — under which use cases may be tiered by potential consequences, transfer of agency and the degree of human oversight, rather than technical sophistication. Both point the same way. Neither tells a bank which controls each system needs.
The question that decides the controls is not what technology a system uses, but what it returns. The same task — sanctions alert triage, for example — can be built three ways, and each needs a different control set.
| Typed decisionValidate it | GenerativeGovern the use | RulesOwn the rules | |
|---|---|---|---|
| What it returns | A choice from a fixed set, often with a confidence score — even when an LLM produces it | Open-ended content with no single right answer; the same input can give different outputs | The result of written logic, the same every time for the same input |
| How it fails | Confident wrong picks; calibration drifts with data, prompt or vendor changes | Plausible but wrong content; behaviour shifts with prompts, retrieval and vendor updates | A misread policy, applied consistently to every case |
| Main controls | Independent validation against labelled outcomes, calibration testing, change control over model, prompt and configuration | Use-case evaluation sets, red-teaming, human oversight, live outcome sampling, configuration change control | Rule review against source policy, regression testing, change approval, exception review |
| Under SS1/23 | A model: the full framework applies | May meet the model definition, but validation alone cannot carry the weight | Outside the model definition, but documented controls expected (1.1(c)); consider MRM where material and complex (1.1(b)) |
Systems that act on their own — AI agents — are sorted by the output they act on, with additional controls on access, approvals and autonomy.
Output decides which control set applies. Consequence decides how intensive those controls must be. Each system is tiered by what happens if it fails, how much it can do on its own, whether its actions can be reversed, and how much human oversight remains — consistent with the consequence-based approach in the OCC’s framework.
The same output class can land in any tier: an LLM summarising internal memos and an LLM drafting customer complaint responses are both generative, but they are not governed with the same intensity.
Three steps, each feeding the next. We work from your existing inventory and policies; where the inventory is incomplete, finding what is missing is part of the work.
Designed to be light on your teams and quick to a decision.
Two free checks show the thinking on a single system before you commit to the whole inventory.
A 30-minute call is enough to see how the sort would apply to your inventory and to agree a fixed scope.
Book a 30-Minute Call Read: The CRO’s AI FrameworkReferences to the FCA’s October 2026 review AI in financial services: good practice and areas for improvement describe practices it highlights; the review creates no new requirements. OCC Bulletin 2026-54 Super Intelligence: Supervisory Framework is an examiner resource and does not establish new requirements for banks; the tiers above are LINXS’s, informed by its consequence-based approach. Nothing on this page is regulatory or legal advice.