A bank's AI agent training plan works best organised by the three lines of defence. The first line, the operations teams who review held actions, certifies first. The second line, risk and compliance, learns to challenge depth decisions and test controls. The third line, internal audit, learns to reconstruct any decision from the record.
Why organise a bank's plan by lines of defence?
Because that is how banks already assign accountability, and how supervisors will read the plan. Model risk is supervised in most banking markets, and an agent that acts on a bank's customers sits squarely inside operational and model risk. A supervisor will ask who decided the agent could act at each depth, who checked that decision, and who tested the checks. The lines of defence answer that directly.
It also stops a common failure. Banks often train their technology teams thoroughly and leave operations staff with a briefing, even though operations staff approve every held payment. What banks typically get wrong is set out in what banks get wrong about AI agent training, and the order of training in how banks should train staff before deploying AI agents.
How do you fill it in?
- Group: use your own teams within each line.
- Decisions they own: name them in agent terms: approving held actions, setting customer limits, approving depth changes, testing controls.
- Certificate needed: before they take those decisions.
- Order: number the groups in training order.
- Evidence: what you would hand a supervisor.
- Renewal owner: who tracks expiry for the group.
Banks with several agents should complete the plan per business line, because a payments agent at depth 4 and a mortgage servicing agent at depth 2 need different reviewer populations.
The template
| Line | Group | Decisions they own | Learning | Practice | Certificate needed | Order | Evidence for supervisors | Renewal owner |
|---|---|---|---|---|---|---|---|---|
| First | ||||||||
| First | ||||||||
| Second | ||||||||
| Third | ||||||||
| Board | ||||||||
| Enabling | IT and engineering |
A worked example
A hypothetical retail bank deploying a payment exceptions agent and a customer servicing agent. Order and figures are illustrative.
| Line | Group | Decisions they own | Learning | Practice | Certificate needed | Order | Evidence for supervisors | Renewal owner |
|---|---|---|---|---|---|---|---|---|
| First | Payment operations reviewers (25) | Approve held repairs and releases at depth 4 | Foundations, then Operator | Two-week practicum on live held payments | Certified Pryme Operator | 1 | Certificate numbers against every approval in the record | Head of payment operations |
| First | Servicing team leads (8) | Approve held account changes; refuse with reasons | Foundations, then Operator | Practicum on held servicing actions | Certified Pryme Operator | 1 | As above | Head of servicing |
| First | Agent owners (2) | Accept the risk of each depth; set customer limits | Foundations, then Architect | Capstone and board review | Certified Pryme Architect | 2 | Signed depth decisions with the Attest evidence | COO |
| Second | Operational risk and compliance (6) | Challenge depth decisions; test controls | Foundations, then Operator | Sample and re-perform held decisions | Certified Pryme Operator | 3 | Control test results | CRO |
| Third | Internal audit (3) | Reconstruct decisions; assess the framework | Foundations, then Operator | Trace ten decisions end to end | Certified Pryme Operator | 4 | Audit workpapers | Chief audit executive |
| Board | Directors | Approve risk appetite for agents | Foundations | Briefing and discussion | Foundations badge | 3 | Board minutes | Company secretary |
| Enabling | Engineering (4) | Build and certify agents; manage connections | Builder | Capstone agent certified to depth 2 or higher | Certified Pryme Builder | 2 | Certification runs | CTO |
Order 1 is the payment and servicing staff, because nothing goes above depth 2 until they are certified. Owners and builders follow, since their decisions shape what reviewers see. The second line trains before the first depth increase, so it can challenge it with understanding. The rule that matters most for a bank: depth is earned, not configured. A business line asking for depth 4 is asking for more evidence first, and the second line needs to know what that evidence looks like. Two related role plans are the training plan template for IT administrators and the training plan template for compliance officers. For costs, see how much AI agent training costs for banks, and for the general order, training teams for AI agents.
Where the Academy fits
Pryme Intelligence Academy's four tracks follow the lines in this plan: Foundations for everyone including the board, Operator for reviewers and second and third line staff, Builder for engineering, and Architect for people leading regulated, multi-agent deployments, assessed with a capstone and a board review by two Pryme assessors. An admin view shows progress, results and expiry dates across the bank.
Questions people ask
Should the second line be trained before or after the first?
After the first line's reviewers and before any agent moves above depth 2. The second line needs to see real held work to challenge it, but must be ready before the first request for more autonomy.
Do directors need certificates?
Directors need the vocabulary and the right questions, which Foundations provides. Certification is for people who take operational decisions about the agent.
How do we show supervisors the plan is working?
Show the record: every approval by a certified person, every depth decision with its evidence, and expiry dates managed before they pass.