Not the decision itself. An AI agent can identify and cite the rule that may have been broken, gather the facts, test them against the firm's materiality criteria, check for similar past breaches and draft a notification. Whether to tell the regulator is a judgement about significance, and the head of compliance makes it, with the accountable senior manager informed.
What makes this decision hard?
Most financial regulators expect firms to tell them promptly about significant breaches of their rules, and to be open with them generally. "Significant" is rarely defined precisely. It depends on harm to customers, the size and duration of the problem, whether it is systemic or a one-off, whether it reveals a control failure, and whether it repeats something seen before.
These are weighed together, often before all the facts are known. A firm that reports too little risks being seen as concealing; a firm that reports every minor slip floods its supervisor and dilutes the signal. That balance is a matter of judgement and relationship, not calculation.
What may the agent do, and what stays with a person?
| Task | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Identifying the rule | Names and quotes the rule or policy that may be breached | 2 | Confirming it is the right rule |
| Facts | Gathers what happened, when, how many customers, how much money | 1 | Confirming the facts |
| Materiality test | Applies the firm's written criteria and shows the result for each | 2 | Weighing the result |
| Pattern check | Searches the breach log for similar past events | 1 | Judging whether it is systemic |
| Remediation | Drafts a remediation plan from similar past cases | 2 | Approving the plan |
| Decision | Never | None | Whether to notify the regulator |
| Notification | Drafts the notice with facts, cause, impact and remediation | 2 | Approving and sending |
| Record | Logs the decision and reasons | 2 | Signing |
The first row matters more than it looks. An agent that says "this may breach our obligations" without naming the rule gives a reviewer nothing to test. The case is made in a compliance agent should cite the rule.
How should materiality criteria be written?
Clearly enough for the agent to apply them and for a person to see how they were applied. Typical criteria include:
- customer detriment above a stated amount or number of customers;
- a breach lasting longer than a stated period;
- a breach in an area the regulator has highlighted;
- a breach caused by a failed control rather than a one-off error;
- a repeat of a breach previously reported.
The agent shows which criteria are met and which are not, with evidence for each. The head of compliance can then disagree with any of them and say why.
An illustrative example
Take a consumer lender that discovers a fault in how it calculated early settlement figures. For three months, some customers were quoted slightly more than they owed.
The agent identifies the relevant rule on early settlement calculations and the firm's own policy, and quotes both. It counts the customers affected and totals the overcharge. It applies the materiality criteria: customer detriment exceeds the firm's threshold; duration exceeds the threshold; the cause is a system change without adequate testing, a control failure. It searches the breach log and finds a similar calculation error two years earlier, which was reported. It drafts a notification and a remediation plan to refund affected customers with interest.
The head of compliance reviews, agrees the breach is significant, and refines the cause section after speaking to the technology team. The accountable senior manager is briefed. Compliance sends the notification. Every step is logged; the log itself is covered in whether an AI agent can keep a compliance breach log.
What if the breach involves personal data?
Then a separate assessment applies, with its own deadline and its own decision about the data protection authority. The two run in parallel and should not wait for each other. See whether an AI agent can decide whether a data breach must be reported and the personal data breach assessment template.
What happens after notification?
Regulators often follow up with questions. The agent can help assemble the evidence they ask for, as covered in how to assemble evidence for a regulator information request with an AI agent. The same rule applies: it prepares, people send.
What controls make it safe?
- No sending capability to any regulator.
- Written materiality criteria, versioned, that the agent applies and shows.
- Every assessment filed, including those where the firm decided not to report, with the reasons.
- Escalation of any breach that meets a criterion to the head of compliance the same day.
- Periodic review of decisions not to report, by someone other than the original decider.
The broader principle is in AI compliance agents: second line, never the last word.
Questions people ask
Can the agent decide a breach is too minor to log?
No. Every breach should be logged, however small. Logging is how patterns become visible and how the firm shows it took them seriously.
Should the regulator be told an agent assessed the breach?
There is no general rule requiring it. If asked, the firm should explain how the assessment was made and who decided.
What if the agent itself caused the breach?
Then it is assessed like any other, and the agent's own authority should drop while the cause is investigated.