Spanish retail bank auditors should be trained to audit AI agents that handle mortgage requests, revolving credit complaints and service for older customers. That means testing approvals and certificates in the record, tracking 90-day agent recertification and rating findings consistently. Banco de España, the AEPD, GDPR, DORA and the EU AI Act frame oversight.
What fills the audit plan at a Spanish retail bank?
Litigation history shapes it. Spanish banks have faced waves of customer claims over mortgage clauses and the cost of revolving credit, so auditors pay close attention to transparency at the point of sale, the clarity of pre-contractual information and how complaints are resolved before they reach the courts or the supervisor's complaints service. Mortgage modifications, including for customers in financial difficulty, are a standing test area.
Service to older and digitally excluded customers is another. Branch networks have shrunk and the sector has committed to better treatment of older customers, and auditors test whether those commitments are met in practice. Fraud, AML and IT complete the plan. Banco de España supervises conduct and, for less significant institutions, prudential matters; significant banks also answer to ECB banking supervision.
How do agents change the audit universe?
Each agent the bank deploys is a new audit object with its own certified depth.
- Revolving credit complaints (depth 2). The agent reads the contract, statements and interest history and drafts the reply. A complaints officer decides and sends.
- Mortgage modification requests (depth 1). It assembles income evidence and the current loan terms, and summarises the options under the bank's policy for a person to decide.
- Older customer service routing (depth 3 within limits). It identifies customers who asked for in-person help and books branch appointments, logging each.
- Pre-contractual information checks (depth 1). It compares the information given to a customer with the product signed and flags gaps.
Audit's own agent can test complete populations from the append-only record at depth 1, for example every complaint reply in a quarter.
What must auditors learn, and what stays with them?
Our ranking of which AI agent skills matter most for internal auditors is a good starting point. In Spain, transparency testing gives it a particular shape: auditors should be able to show from the record what information the agent placed in front of a customer and when, because that is what a court or the supervisor will ask.
Recertification is the next skill. Agent certificates lapse after 90 days; an Attest run that clears no depth drops the agent to depth 1 the same day. A complaints agent that drafted replies on a lapsed certificate is a finding even if the replies were good, because the control did not hold. Our guide on keeping internal auditors ready for an AI agent's 90-day recertification shows how to build certificate testing into each sample.
Calibration is third. Auditors from different backgrounds rate agent findings differently unless they practise together. Calibration sessions for internal auditors on anonymised cases settle the scale. Pryme Intelligence Academy's Operator track, which ends in a practicum signed off by an assessor, gives auditors a shared experience of what good review looks like.
What stays with the auditor: the plan, the opinion, ratings and reporting. Our piece on whether AI agents will replace internal auditors explains why.
Which Spanish rules shape oversight and literacy?
Banco de España supervises banks' conduct and handles customer complaints through its own service, and it is the national authority for less significant institutions within ECB banking supervision. The EBA sets EU-wide guidelines on internal governance and loan origination that reach agent deployments in credit.
The EU AI Act requires AI literacy among staff operating AI systems under Article 4, and lists creditworthiness assessment of individuals as high-risk in Annex III, bringing in Article 26 deployer duties and Article 14 human oversight for that use. Spain has also set up a national agency to supervise AI.
GDPR governs customer data, with Article 22 on solely automated decisions and Article 35 impact assessments. The AEPD supervises data protection and is where customers take complaints about how their data was used. DORA applies to banks and covers ICT risk, incident reporting, resilience testing and third-party risk, including the agent provider.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
A 90-day training plan
Month one. All auditors complete basic literacy on governed agents. The head of internal audit lists each agent with its capabilities, depth and certificate history.
Month two. Pilot an audit of revolving credit complaint replies. Test who approved, what the agent cited, certificate currency on each date, and whether replies were clear to the customer.
Month three. Hold the first calibration session, audit older customer routing, and write the standing programme for agents.
Questions people ask
Is a complaints agent high-risk under the AI Act?
Complaint handling is not the creditworthiness use listed in Annex III. Article 4 literacy and good oversight still apply, and complaint outcomes matter to the supervisor.
What should audit test for older customers?
That requests for human help were honoured, that the agent did not push digital channels on customers who declined them, and that appointments were kept.
How does audit stay independent while using agents?
By keeping its own agent, bounds and sources separate from the business. Our piece on why internal auditors are the real control explains audit's role, and the guide to AI agent skills by role covers others.