A compliance team's AI agent competency matrix covers two kinds of skill: reviewing what agents produce, such as customer communications and complaint classifications, and overseeing how agents are governed, such as testing decisions from the record and challenging depth changes. The template groups eight skills into those two clusters, defines four levels, and records who holds each.
Why does compliance need a matrix of its own?
Compliance teams meet agents twice. First as reviewers: the agent drafts a customer letter or classifies a complaint, and compliance signs it off. Second as overseers: someone must test whether the agents operate within their bounds, whether held actions were approved by qualified people, and whether a request to raise an agent's depth is backed by certification evidence.
Most compliance training covers the rules. Fewer teams have trained people to reconstruct an agent's decision from an append-only record, or to read a certification run's gate results. The matrix shows where that skill sits, and whether more than one person has it. It is a form of training matrix; it is not an authority matrix, though it should inform one.
How do you fill it in?
- Rate each person on each skill: Foundation, Working, Advanced or Lead.
- Rate "Advanced" only with evidence: a practicum log, a completed review file, an assessment.
- Record credentials and expiry.
- Count Advanced-or-above per skill. Any oversight skill held by only one person is a key-person risk.
Levels: Foundation (understands the concept); Working (applies it with review); Advanced (applies it alone to a standard others rely on); Lead (sets method, reviews others, explains it to the board or a supervisor).
The competency matrix template
Cluster 1: reviewing agent outputs
| Skill | What "Advanced" looks like |
|---|---|
| R1 Customer communications | Signs off agent-drafted letters and messages as clear, fair and not misleading, and fixes the source when a draft copies an old template |
| R2 Complaint classification | Corrects the agent's classification and spots complaints hidden in queries |
| R3 Exceptions and refusals | Rules on disputed refusals and exception requests within policy |
| R4 Breach candidates | Rates agent-flagged events by customer impact and escalates the same day where needed |
Cluster 2: overseeing agent governance
| Skill | What "Advanced" looks like |
|---|---|
| G1 Testing from the record | Reconstructs any verdict from the record: bounds, deciding bound, sources, approver |
| G2 Certification evidence | Reads gate results and knows that an agent's certificate lapses after 90 days and a run that clears no depth drops it to depth 1 the same day |
| G3 Depth and limit changes | Challenges requests to raise depth or limits without certification evidence |
| G4 Oversight duties | Maps the organisation's agents to duties such as human oversight (EU AI Act Article 14), AI literacy (Article 4) and limits on solely automated decisions (GDPR Article 22) |
Who holds what
| Person | Role | R1 | R2 | R3 | R4 | G1 | G2 | G3 | G4 | Credential | Expires |
|---|---|---|---|---|---|---|---|---|---|---|---|
A worked example
Take a sample payment institution in the EU with a compliance team of five. Values are illustrative. F, W, A and L for the four levels.
| Person | Role | R1 | R2 | R3 | R4 | G1 | G2 | G3 | G4 | Credential | Expires |
|---|---|---|---|---|---|---|---|---|---|---|---|
| I. Novak | Head of compliance | L | A | L | L | A | W | A | L | Operator certificate | 31 Mar |
| F. Romero | Compliance officer | A | A | A | A | W | F | W | A | Operator certificate | 30 Sep |
| D. Weiss | Compliance officer | A | L | A | W | F | F | F | W | None | |
| M. Ortiz | Monitoring analyst | W | A | W | A | A | A | A | W | Operator certificate | 31 Jul |
| K. Laine | Compliance analyst | W | W | W | W | W | W | F | F | Foundations badge | No expiry |
Cluster 1 is in good shape: every review skill has at least two people at Advanced or above. Cluster 2 is not. G2, certification evidence, has one person at Advanced, and it is the monitoring analyst, not a compliance officer. If M. Ortiz is away when the payments agent fails a run, nobody in compliance can explain to the board what changed.
The plan: F. Romero and I. Novak each review the next two certification runs with M. Ortiz; D. Weiss builds G1 through a supervised audit sample; the approver rule for the compliance team requires Advanced on R1 for anyone signing off customer communications. IT and support teams use the same two-cluster idea from different angles; compare the competency matrix for an IT team and the matrix for a support team.
Where the Academy fits
Pryme Intelligence Academy's Operator track covers cluster 1 and much of G1. The Builder track, ending in a capstone agent certified in Attest, builds G2. The Architect track, for people who lead regulated, multi-agent deployments and ending in a board review with two Pryme assessors, is the natural route to Lead on cluster 2. See AI agent skills by role.
Questions people ask
Does every compliance officer need cluster 2?
No. Every officer needs Foundation on cluster 2; at least two people should reach Advanced on each oversight skill.
Who rates the head of compliance?
The executive they report to, or the audit committee chair, using the same evidence standard.
How does this matrix help with a supervisor's visit?
It shows who in compliance can explain how agents are governed, and that more than one person can. That is usually the first question.