How to assemble evidence for a regulator information request with an AI agent

Split the request into numbered items, and give the agent everything up to the review. It maps each item to its data owners, drafts the internal requests, gathers the evidence with sources and dates, and checks it for gaps and for consistency with earlier submissions. Subject experts, legal and an accountable senior manager review and sign, and a person submits.

What is the process, and who owns it?

A supervisor asks a firm for information: complaint data for a product, the governance papers behind a decision, evidence of how a process works, figures for a period. Requests arrive with a deadline and, often, a precise list of items. The response becomes part of the supervisory record, and anything inconsistent or incomplete invites follow-up.

A regulatory affairs or compliance team usually owns the response and coordinates it. Data owners across the business supply the evidence. Legal reviews. In the UK, the Senior Managers and Certification Regime means a named senior manager is often accountable for the area concerned and for the answer. That accountability is why whether an agent can answer regulator information requests is answered: it prepares, people answer.

What are the steps?

1. Person, regulatory affairs: logs the request. Deadline, scope, coordinating owner, accountable senior manager.
2. Agent, depth 1: splits it into items. Each question or document request numbered, using the regulator's own wording. It does not paraphrase the scope.
3. Agent, depth 1: maps items to owners and systems. Who holds the data, which system, which period.
4. Agent, depth 2: drafts internal requests. One per data owner, listing their items, the period and the internal deadline. The coordinator sends them.
5. Agent, depth 1: gathers and catalogues evidence. Each document or extract recorded with its source, version, extraction date and the item it answers.
6. Agent, depth 1: checks completeness. Every item has evidence, or an explanation of why not.
7. Agent, depth 1: checks consistency. The same figure reported the same way across items, and against what the firm has told the regulator before.
8. Agent, depth 2: drafts the response pack. An index, a short answer per item pointing to its evidence, and a list of gaps and caveats.
9. Person, subject experts: review their items.
10. Person, legal: reviews for privilege, confidentiality and personal data that should be minimised.
11. Person, accountable senior manager: signs off.
12. Person, regulatory affairs: submits.

Which controls apply, and what evidence does each leave?

Regulator's wording kept. Items are tracked in the original words, so scope does not drift. Evidence: the item list, matched to the request.

Catalogue with provenance. Every piece of evidence shows where it came from, when it was extracted and which version it is. If the regulator asks a follow-up, you can show exactly what you sent and why.

Consistency report. Differences between figures in this response, or between this response and earlier ones, are listed with how each was resolved and by whom.

Legal review on file. What was withheld or redacted, and the reason.

Named sign-off. The senior manager's approval of the final pack is filed. The agent never submits.

What should you measure?

• Items complete by the internal deadline. Late items are where pressure leads to errors.
• Inconsistencies found before submission.
• Follow-up questions caused by gaps or inconsistencies.
• Time spent by data owners. The agent's clearest benefit is fewer, better-targeted requests.
• Evidence reused in later requests, where the catalogue saves rework.

Where does it usually go wrong?

Scope drift. Paraphrasing a request widens or narrows it. Answering more than was asked can disclose material the firm did not need to share; answering less invites a second request.

Inconsistency with earlier submissions. A complaint figure that differs from an earlier return, without explanation, draws attention. The consistency check exists for this.

Wrong period or cut-off. Data extracted at the wrong date, or for the calendar period when the regulator asked for a financial one.

Mixed versions. Data owners send updated extracts after review has started, and the pack ends up mixing old and new figures. The catalogue should mark superseded evidence, and the agent should re-run the consistency check whenever anything is replaced.

Answers that outrun the evidence. A draft says a control operates effectively when the evidence only shows it exists. Each draft answer should claim no more than its evidence shows, and experts should strengthen a claim only by adding evidence.

Personal data not minimised. Customer-level data sent when aggregate data would have answered the question. Legal review should catch it; the agent should flag it first.

Treating law enforcement requests the same way. Requests from police or other authorities have different legal bases and tipping-off risks. See whether an agent can respond to a law enforcement request and responding to law enforcement information requests.

Where requests concern customer outcomes, the evidence often comes from routine monitoring; FCA Consumer Duty evidence for monitoring outcomes of AI agents covers building it in advance. The position of compliance agents overall is set out in AI compliance agents.