AI agent training for internal auditors in retail banking in France

Periodic control teams in French retail banks need training to audit AI agents that process estate files, assess consumer credit and handle complaints. They must test verdicts, approvals and certificates from the record, and recognise when credit scoring makes an agent high-risk. Their opinion stays independent. The ACPR, CNIL, EU AI Act, GDPR and DORA set the frame.

What does periodic control cover in a French retail bank?

French banking rules separate permanent control, run by the business and second-line functions, from periodic control, which is internal audit. Periodic control reviews the whole organisation on a cycle, reports to the executive body and the board's committees, and must stay independent of the activities it audits.

In retail banking, the cycle covers consumer and mortgage credit, current account fees and the protections for financially fragile customers, account switching between banks, dormant accounts, estate files when a customer dies, payment fraud, and complaints, including those that go to the bank's mediator. The ACPR inspects, and for larger groups ECB banking supervision also looks at internal audit's coverage.

Where do agents enter the audit universe?

Each agent a bank deploys is a new audit object with a certified depth, and each of its actions needs a depth.

• Estate file processing (depth 2). The agent reads the death certificate, notary correspondence and account data, then drafts the account freeze and release instructions for a person to approve.
• Consumer credit affordability (depth 1). It gathers income and spending evidence and drafts an affordability summary. A credit officer decides.
• Fragile customer detection (depth 1). It flags customers who meet the bank's criteria for fee protections, for a person to confirm.
• Complaint replies (depth 2). It drafts responses in French citing contract terms. A complaints officer sends.

Audit's own agent can test full populations from the append-only record at depth 1, such as every estate release in a quarter, and draft workpapers at depth 2.

What must auditors learn, and what stays with them?

Our ranking of which AI agent skills matter most for internal auditors puts classification near the top, and French retail banks show why. Creditworthiness assessment of individuals is high-risk under the EU AI Act. An auditor must be able to tell whether the affordability agent falls into that use and, if so, test the deployer duties: oversight by competent people, logs, information to customers, and the impact assessment where required.

Estate files test provenance. A death certificate is a signed document from an identifiable issuer; a letter purporting to come from a notary arrives as external until verified. Auditors should test that no release of funds rested on external correspondence alone and that every release was held for a named person.

Certification is the third skill. Agent certificates lapse after 90 days and a lapse or a run that clears no depth drops the agent to depth 1 the same day. Auditors should check certificate history against the dates of sampled decisions.

Auditors who want to see review from the inside can take operator-level training and keep a practicum log template for internal auditors as evidence.

What stays with the auditor: the audit cycle, the opinion, finding ratings and reporting. Our piece on whether AI agents will replace internal auditors explains why.

Which rules in France shape oversight and literacy?

The EU AI Act applies. Article 4 requires AI literacy among staff operating AI systems. Annex III lists creditworthiness assessment and credit scoring of natural persons as high-risk, which brings Article 26 deployer duties, Article 14 human oversight and Article 12 logging into scope; Article 27 requires certain deployers, including those assessing creditworthiness, to assess the impact on fundamental rights.

GDPR governs customer data. Article 22 limits solely automated decisions with legal or similarly significant effects, such as refusing credit, and Article 35 requires an impact assessment for high-risk processing. The CNIL supervises data protection; the ACPR supervises banks and their conduct, with the EBA setting EU-wide guidelines and ECB banking supervision covering significant banks.

DORA applies to banks, covering ICT risk management, incident reporting, resilience testing and third-party risk, including the provider of the agents. Basel Committee principles on operational resilience sit behind it, and model risk is supervised as part of prudential oversight.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

A 90-day training plan for periodic control

1. Weeks 1 to 3. All auditors cover depth, the minimum chain, verdicts, certification and the record. Managers add agents to the audit universe with capability, depth and expiry.
2. Weeks 4 to 7. Pilot an audit of estate file processing: every release, its approver, provenance of supporting documents, certificate currency.
3. Weeks 8 to 10. Review the affordability agent's classification under the AI Act and test the deployer duties if it is high-risk.
4. Weeks 11 to 13. Write the standing programme, agree ratings, and record training in the training plan template for internal auditors.

Where the Academy fits

Pryme Intelligence Academy's Foundations badge is free, does not expire and is stamped with the product version, which gives periodic control a documented literacy baseline. Auditors who lead agent audits can take the Operator track; its written exam is passed at 32 of 40 questions and its module tests are set in retail banking and the auditor's role.