AI agent training for risk managers in retail banking in Ireland

Irish retail bank risk managers need training that ties agents to the controls they already own: credit decisions that are high-risk under the EU AI Act, payee checks under the EU Instant Payments Regulation, ICT third-party oversight under DORA, and named accountability. They must read certification evidence and the record. Risk appetite and arrears decisions stay with people.

What shapes the risk manager's job in Irish retail banking?

Ireland's retail market is concentrated in a few banks, alongside credit unions and non-bank lenders. Mortgages dominate, and the legacy of past arrears and mortgage pricing failures has left the Central Bank of Ireland and customers alike with long memories. Any change that affects how borrowers are treated draws attention, and rightly so.

Risk managers here own the risk appetite framework, credit risk monitoring across mortgages and consumer lending, operational and ICT risk, conduct risk, and outsourcing. Larger banks answer to ECB banking supervision as well as to the Central Bank. Ireland's individual accountability framework for senior executives means the question "who is responsible for this agent?" has a legal edge.

Where will agents change the work?

• Mortgage arrears case preparation, depth 2. An agent assembles the borrower's history, income evidence and options under the bank's arrears process and drafts a case note. A person decides on any arrangement. This is the area where mistakes cost most in trust.
• Payee verification exceptions, depth 2 to 3. When an outgoing instant payment returns a name mismatch, the agent drafts the customer warning and, within bounds, pauses the payment for confirmation. Releasing a payment after a mismatch is held.
• Credit pre-assessment for personal loans, depth 2. The agent applies policy to the application and drafts a recommendation. A credit officer decides.
• DORA third-party oversight, depth 1. The agent reads supplier attestations and service reports and flags gaps in the register.
• Risk event drafting, depth 2. Operational events drafted into the register with cause and amount.

Moving money, changing loan terms or writing off a balance is depth 4 and held for a named approver.

What should risk managers learn, and what remains theirs?

The essential lesson is that authority is granted per agent, per customer, proven on the bank's own cases, enforced at the moment of action, and that it expires. A risk manager should know that an agent scoped to draft arrears notes is not scoped to propose arrangements, even if the two look similar, and that a run that clears no depth drops the agent to depth 1 the same day.

The second lesson is that findings should change the agent, not just the file. If a review finds the arrears agent treating a borrower's self-declared income as verified, the fix is in the agent's sources and the provenance it accepts. Our guide on teaching risk managers to bank corrections shows how to turn findings into changes the record captures.

What stays with people:

• any arrangement, restructure or legal step for a borrower in arrears;
• credit decisions outside policy;
• conclusions on conduct failures and remediation;
• reporting to the board, the Central Bank and the ECB.

The argument that these people are the safeguard is in why risk managers are the real control, and whether agents will replace risk managers answers the question staff will ask.

Which Irish and EU rules shape oversight and literacy?

The EU AI Act applies directly. Annex III lists creditworthiness assessment and credit scoring of natural persons as high-risk, so personal loan and mortgage agents bring deployer duties under Article 26 and human oversight under Article 14. Article 13 requires providers to give deployers enough information to use the system properly, which the bank's risk function should demand and read. Article 4 requires AI literacy among staff who use AI systems.

The EU Instant Payments Regulation requires payment service providers to verify the payee's name. An agent handling mismatches is part of that control, and its bounds must reflect the bank's process. PSD2 strong customer authentication still applies to the payments themselves.

DORA applies to banks from 17 January 2025. An agent platform is an ICT third-party service, and an agent that fails during payment processing may produce an ICT incident to classify. GDPR governs customer data, enforced by the Data Protection Commission; Article 22 limits solely automated decisions with significant effects, which include refusing credit. The Central Bank of Ireland supervises banks and credit unions, with the EBA setting common standards.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

How should the 90 days be structured?

1. Days 1 to 20. Foundations for risk, credit, arrears and payments operations. Name the senior executive accountable for each agent.
2. Days 21 to 40. Replay a quarter of arrears cases and payee mismatches at depth 1 and compare with what happened. Note every case where declared evidence had been treated as verified.
3. Days 41 to 60. Write the bank's own limits for each agent. Approvers sit the operator exam.
4. Days 61 to 80. Two-week practicum on live held items, followed by calibration on arrears cases.
5. Days 81 to 90. Board paper: agents, depth, accountable executives, approvers, lapse dates and literacy evidence.

The wider role map is in AI agent skills by role.

Where the Academy fits

Pryme Intelligence Academy issues certificates through VerifyDoc.ai, and a lapsed or revoked certificate shows as such on the same page. That matters to an Irish bank that must show who was competent to approve which decision at the time. Approvers take the Operator track; module tests are set in retail banking and in the learner's role.