Can an AI agent sign a compliance attestation?

No. A compliance attestation is a named person's statement that, to the best of their knowledge, something is true, and an AI agent cannot make it. The agent can assemble everything behind it: control test results, exceptions, sub-certifications from control owners and open issues. The signatory must read that evidence, form their own view and sign.

What is an attestation, and why must a person give it?

Firms attest to many things: that controls operated during a period, that a regulatory return is accurate, that the firm meets a licence condition, that a policy was followed, that a senior manager took reasonable steps in their area. Regulators, auditors, boards and counterparties rely on them. Under regimes with named individual accountability, such as the UK's Senior Managers and Certification Regime, an attestation is part of how a senior manager shows they discharged their responsibilities.

The value of an attestation lies in the signer. Someone with authority and knowledge is putting their name to a statement and accepting the consequences if it proves false. An agent's output cannot carry that weight, because there is no one behind it to hold to account. The same reasoning stops an agent signing a contract or signing off a set of accounts.

What evidence does the agent assemble?

A good attestation pack answers the question every signer should ask: what would I need to see to be comfortable signing this?

1. The statement: exactly what is being attested, quoted, with the period and scope.
2. Supporting controls: each control that underpins the statement, with its owner.
3. Test results: for each control, whether it was tested in the period, by whom, and the result.
4. Exceptions: failures, breaches, incidents and audit findings in the period that touch the statement.
5. Sub-certifications: confirmations from control owners and managers in the chain, with any qualifications they added.
6. Open issues: remediation not yet complete, with dates.
7. Changes: what changed in the period, such as new systems, staff turnover or process changes, that could affect the statement.
8. A draft attestation, including any qualification the evidence suggests is needed.

The pack should make bad news easy to find. If an exception undermines the statement, it belongs at the top, not on page forty.

What does the signer keep?

• Reading the evidence and deciding whether it supports the statement.
• Asking questions of control owners and challenging weak sub-certifications.
• Deciding whether to sign as drafted, sign with a qualification, or decline to sign.
• The wording of any qualification.
• The signature itself, and the accountability that comes with it.

A signer who signs because the agent's pack "looked complete" has not attested to anything. The agent makes it faster to reach an informed view. It does not replace forming one.

What does an attestation look like in practice?

Take a payments firm whose head of operations must attest each quarter that customer funds were safeguarded in line with the firm's procedures.

The agent assembles the pack. Daily safeguarding reconciliations ran on every business day. Two showed shortfalls, both corrected the next day, with incident records. The control owner's sub-certification is clean. But the agent also finds that the bank holding one safeguarding account changed its statement format mid-quarter, and for nine days the reconciliation used a manual workaround that was not documented in the procedure.

The draft attestation suggests a qualification noting the workaround. The head of operations asks the reconciliation team how the workaround was checked, satisfies herself that balances were correct, and signs with the qualification. The procedure is updated. Her name is on the statement, and her judgement is what it rests on. Who should sign which certification is discussed in the process owner should sign off certification, not the vendor.

Which controls keep attestations honest?

• No signing capability. The agent cannot apply a signature, electronic or otherwise.
• Exceptions surface first. The pack orders evidence by its effect on the statement.
• Qualifications are proposed when evidence warrants. The agent drafts them rather than leaving them for the signer to think of.
• Sub-certifications are checked. The agent flags sub-certifications that contradict test results.
• The signed version and the pack are filed together, so anyone can later see what the signer saw.

The general principle is in our guide to AI compliance agents.

Where Pryme fits

In Pryme, signing is not a capability any agent can hold. The agent's work ends with the evidence pack and a draft statement, held for the named signer. Because every control an agent ran is filed with its verdicts, the pack can show not only what was tested but what agents were refused or held from doing.