Ireland's financial regulator already holds individuals to account for what happens on their watch, and that now includes AI agents. The Central Bank of Ireland expects firms to put competent, accountable people in control roles and to treat consumers fairly. Staff who approve, edit or stop an agent's actions need training that shows they can do it.
What does the Central Bank of Ireland expect?
Irish financial regulation leans heavily on people. Firms must ensure that individuals in certain roles are fit and proper, competent and capable, honest and financially sound. Senior executives carry defined responsibilities, and conduct standards apply to staff at many levels, including acting with honesty, due skill, care and diligence. Consumer protection rules require firms to act in customers' best interests and treat them fairly. Staff who advise consumers on retail financial products must meet minimum competency standards and keep their knowledge current.
Read together, these produce a clear expectation for agents. If a firm relies on a person to check an agent's work, that person must be competent for the check, the firm must know who is responsible for the agent, and the outcome for the consumer must be fair regardless of how much of the work was automated.
The EU layer applies in full. DORA covers ICT risk, incident reporting, resilience testing, third-party risk and staff training. The EU AI Act asks for AI literacy under Article 4 and, for high-risk uses such as credit scoring of individuals and life and health insurance pricing, human oversight under Article 14 and deployer duties under Article 26. The GDPR applies to the data, and the Data Protection Commission is Ireland's supervisory authority for it.
Who does this reach?
Banks, credit unions, insurers, investment firms, payment and e-money institutions, and other firms authorised by the Central Bank of Ireland. The largest banks are directly supervised through ECB banking supervision, with the Central Bank taking part.
Inside a firm, the reach follows roles:
- Senior executives whose responsibilities include a process an agent works in.
- Reviewers and team leads who approve held actions and sign off agent drafts.
- Advisers subject to minimum competency standards who now send agent-drafted explanations to consumers.
- Risk, compliance and internal audit who test the controls.
The adviser point is distinctive. Ireland already requires that people advising consumers know the products. An agent drafting a product explanation does not reduce that duty. It adds a skill: checking a draft against what you know to be true, under time pressure, and declining it when it is wrong.
What does competence mean when the agent acts?
A competent overseer of a governed agent understands five things and can show it on real cases:
- Depth, and the depth each action needs. The same agent may read account history at depth 1, draft letters at depth 2 and execute routine changes at depth 3. Each needs a different kind of review.
- The minimum chain. Every action meets role scope, the agent's certificate, its sources, the firm's limits and the platform guardrails, and the lowest wins. The verdict names the bound that decided.
- The four verdicts. Allowed, held for a named person, refused as outside bounds, or withheld at the platform floor. Only held actions are the reviewer's to decide.
- Provenance. Sealed facts from the system of record outweigh signed, declared and external ones. An external claim cannot authorise a payment.
- Lapse. The agent's certificate lapses after 90 days, and a run that clears no depth drops it to depth 1 the same day.
A reviewer who knows these can explain a decision to a consumer or a supervisor. One who does not is relying on the agent to be right.
How do you meet these expectations?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Fit, competent people in control roles | Approval rights tied to a current, role-specific credential | Credential register matched to approvals in the agent's record |
| Defined senior responsibility | Each agent capability mapped to a named senior executive | Responsibility statements referencing the agent |
| Due skill, care and diligence | Reviewers record a reason when they decline or edit a held draft | Decline and edit reasons stored with each verdict |
| Fair consumer outcomes | Sample reviews of agent-assisted consumer outcomes | Quality review reports and remediation actions |
| Minimum competency for advisers | Agent-drafted advice reviewed by a qualified adviser before sending | Adviser approvals with their competency status |
| ICT training under DORA | Drills on agent incidents, lapses and drops to depth 1 | Drill reports and escalation times |
Testing competence well depends on good questions. A firm that builds its own assessment should understand what a question bank is and why questions must change as the agent does. The broader training picture for Irish firms is in what AI agent training organisations in Ireland need.
What will the Central Bank ask?
Expect supervisors to start from the person. Who is responsible for this agent at senior level? Which staff approve its held actions, and how did you assess their competence? Show us a consumer complaint involving agent output and how it was resolved. What training do advisers receive on checking agent drafts? How would the process run if the agent dropped to depth 1 tomorrow?
They will also look for culture: whether staff feel able to decline the agent's work, and whether declines are reviewed and learned from. A team that never declines anything is a warning sign, not a success. A role-level example is in AI agent training for fraud analysts in e-commerce in Ireland, and the Dutch comparison is in De Nederlandsche Bank and AFM expectations.
What do these expectations not cover?
They do not set AI-specific training content or require a named credential. They do not decide what depth an agent may hold. Data protection sits with the Data Protection Commission. And they do not shift responsibility to a technology provider: outsourcing an agent leaves the firm, and its named individuals, accountable. Our guide to AI literacy and certification for people who work with agents covers how to structure the evidence.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where the Academy fits
Pryme Intelligence Academy's Certified Pryme Operator credential combines a written exam with a two-week practicum of real review decisions, with no missed red line allowed and sign-off by a Pryme assessor. It is valid for 12 months and listed on a public register by name, credential and expiry, which gives an Irish firm a dated, checkable piece of competence evidence for each reviewer.
Questions people ask
Does a senior executive need to be trained to operate an agent?
No, but they must understand it well enough to discharge their responsibility: what it does, at what depth, who reviews it, and what happens when it fails. Foundation-level literacy is usually the right level.
Are credit unions expected to meet the same standard?
Credit unions are supervised by the Central Bank and face the same principles, applied in proportion. A credit union using an agent to draft member letters needs reviewers who check them, even if the scale is small.
What if a reviewer disagrees with the agent often?
Frequent disagreement is information. It may mean the agent's bounds or sources need work, or that the reviewer needs coaching. Either way, the decline reasons in the record show which.