It can write the draft; it cannot set the policy. An AI agent can map the obligations a policy must meet, compare them with your procedures, find gaps and write a clear draft. The positions the policy takes, the risk appetite it sets and its approval stay with the policy owner and, for key policies, the board.
What is a compliance policy for?
A compliance policy states what the firm will do to meet its obligations and how much risk it will accept. It sets positions: which customers the firm will not take on, what gifts staff may accept, how conflicts are managed, when transactions are escalated. Procedures then describe how to carry those positions out.
Those positions are choices. Two firms under the same rules can write very different AML policies, one declining whole categories of customer, the other accepting them with enhanced measures. The rules set the floor; the policy sets where the firm stands above it. That choice is what a person must make.
What evidence does the agent assemble?
- Obligations: every rule the policy must address, from the obligations register, with the source quoted.
- Current practice: the procedures, forms and controls in use, and how they actually run.
- Gaps: obligations with no policy statement, policy statements with no procedure, and procedures that contradict the policy.
- Change drivers: regulatory changes, audit findings, breaches and incidents since the last review.
- Decisions needed: points where the policy must take a position and the options available, with their implications.
- A draft in the firm's template, with each statement linked to the obligation it meets.
When a new regulation arrives, the mapping step is the core of the work; see mapping a new regulation to your policies.
What does a person decide?
| Decision | Who |
|---|---|
| The firm's position on each point where options exist | Policy owner |
| Risk appetite statements | Policy owner, with risk and the board where required |
| Whether the draft meets the obligations | Compliance |
| Whether the policy is workable for the business | Business owners |
| Approval | The committee or board named in governance |
The "decisions needed" list is the most useful thing the agent produces. A policy drafted without surfacing those decisions tends to fudge them, using wording like "appropriate measures will be taken" where a position was required. Listing them forces the owner to decide.
What does a drafted policy look like?
Take a small investment firm rewriting its gifts and hospitality policy after an audit finding that the current one is vague.
The agent maps the obligations: anti-bribery requirements, conflict of interest rules, and the firm's regulator's expectations on inducements. It reads the current policy, the gifts register and the past year's entries. It finds that the policy sets no value limit, the register shows several gifts of high value from one broker, and the procedure does not say who approves.
The draft sets out the structure and wording, and lists four decisions for the owner: the value limit above which approval is needed, who approves, whether gifts from brokers are treated differently, and whether hospitality from firms in an active tender is banned. The head of compliance takes the decisions, the agent completes the draft, and the board approves it. The agent then updates the procedure and the register form to match.
Do written policies bind AI agents?
No, not on their own. A policy written for staff does not change what an agent is able to do. An agent bound by "staff must not accept gifts over the limit" can still draft an acceptance. What binds an agent is an enforced bound at the moment of action, which is why a policy that applies to agents needs a matching control in the system the agents run on. The argument is in written AI policies do not bind agents; enforced bounds do.
Policies about agents themselves are a related task; see how to write an AI agent policy. And when the agent drafts a policy, its brief should say what the policy is for and who it serves, as with any brief; see how do you write a brief for an AI agent?
Which controls keep policy drafting sound?
- Every statement traces to an obligation or a decision. Nothing in the policy is unexplained.
- Decisions are listed, not buried. The owner sees every choice the policy makes.
- Draft and approved versions are kept. Changes between them show what people decided.
- Procedures follow. When the policy changes, the agent flags procedures and controls that no longer match.
The general principle is in our guide to AI compliance agents.
Where Pryme fits
In Pryme, the approved policy library is a sealed source: agents read the version in force, not a draft. When a policy changes, the bounds of the agents it governs are updated through their briefs and re-certified, so an approved policy and what agents are allowed to do stay in step.
Questions people ask
Can the agent keep policies up to date automatically?
It can draft updates when rules change and flag policies past their review date. Updates still need the owner's approval.
Should the agent write procedures as well as policies?
Yes; procedures are where most of the drafting effort lies. The business teams who follow them should review the draft for workability.
Can the agent answer staff questions about policies?
Yes, from the approved text. Questions the policy does not answer go to compliance.