Can an AI agent answer regulator information requests?

It can prepare the answer, but it should not send it. An AI agent can split a regulator's request into items, find the data, draft responses and check them against what the firm said before. A named person must review every item, decide what to disclose, and approve and send the response, because someone has to stand behind it.

Why can the agent not reply on its own?

Because a reply to a regulator carries consequences an agent cannot weigh. An inaccurate or incomplete answer can be treated as misleading the regulator, which is serious in itself. The firm also has to decide judgement questions: how to interpret an ambiguous request, whether some material is privileged, whether to provide context alongside raw data, and whether the request has surfaced something that needs separate reporting.

Those decisions sit with compliance, legal and the senior manager responsible for the area. The wider principle is set out in AI compliance agents: second line, never the last word.

What may the agent do, and what stays with people?

The assembly work is laid out in detail in how to assemble evidence for a regulator information request with an AI agent.

What could go wrong?

Over-disclosure. An agent asked to gather "all records about product X" may sweep in customer data, legal advice or unrelated matters. Sending more than was asked is not harmless; it can expose personal data and privileged material. What sensitive information disclosure is covers the general risk.

Inconsistency. If the firm told the same regulator something different in an earlier submission, a new answer that contradicts it raises questions. The agent's consistency check is valuable precisely because people forget what was said before.

Hidden issues. Gathering evidence sometimes reveals a breach. The agent should flag it to compliance, not decide whether it needs reporting. That decision is covered in whether an AI agent can decide whether to report a rule breach to a regulator.

An illustrative example

Take a consumer credit firm that receives a request from its conduct regulator for information on how it handled customers in arrears over a twelve-month period: policies, volumes, a sample of case files, and board minutes discussing arrears.

The agent splits the request into eight items, proposes owners, and starts gathering. It pulls the arrears policy versions in force during the period, case volumes from the collections system, and minutes mentioning arrears. For the case file sample, it proposes a selection method and flags that the files contain customers' health information. In checking consistency, it finds that a previous submission described a forbearance option the current policy no longer includes, and notes when it was withdrawn.

The head of compliance reviews each draft, agrees the sample method with legal, redacts unnecessary personal data, and adds a short explanation of the policy change. The accountable senior manager approves, and compliance sends the pack.

Is a law enforcement request different?

Yes. Requests from police or other agencies come with their own legal basis, confidentiality requirements and, often, restrictions on telling the customer. The agent's role is similar, gathering and drafting, but the checks on legal basis and tipping off are stricter. See how to respond to law enforcement information requests with an AI agent.

What controls make it safe?

• No sending capability. The agent cannot submit anything to a regulator.
• Every answer sourced. Each claim links to the record it came from.
• A record of the scope applied to each search, so it is clear what was and was not looked for.
• Personal data flagged before anything leaves the firm.
• Named approvals on each item and on the final pack.

Some regulators also ask about the firm's own use of AI. Whether agents themselves need to be notified or registered is covered in whether you need to register AI agents with a regulator.