A certificate renewal checklist for AI agents lists what to do before an agent's certificate lapses: record what has changed since the last run, refresh the case set with recent work, re-run every gate, compare results with the last certificate, decide the agent's depth, and plan staff cover in case renewal is late. Start 30 days before expiry.
Why does renewal need a checklist?
Certificates lapse after 90 days. That fixed term exists because agents drift: the work changes, sources change, model providers update their models, and the cases the agent was proven on become less like the cases it handles. Renewal is the point where you check whether the proof still holds. Why an agent certificate lapses explains the reasoning.
Without a checklist, renewal tends to become a re-run of the old test set. That proves the agent can still pass the test it passed before. It says little about whether it can handle what arrived last month.
When should each step happen?
Work back from the expiry date on the certificate.
- Day 60. Open the checklist; record changes; start refreshing cases.
- Day 75. Run certification.
- Day 80. Review results; resolve any failure.
- Day 85. Issue the new certificate.
- Day 90. Old certificate lapses. If no new one exists, the agent loses its certified depth.
The gap between run and expiry leaves room for one failure and a fix. A run on day 89 that fails leaves none.
How do you complete the checklist?
Fill it in against the existing certificate, using the fields from the AI agent certificate template. Two items deserve the most care.
Changes since the last run. List every change to the brief, sources, connections, customer limits and the underlying model. Some of these should already have triggered an early review; if they did not, note it.
Case set refresh. Replace a share of the old cases with recent ones from production, including every case a person rejected or heavily edited, and every incident. Keep enough old cases to compare scores fairly. The aim is a set that reflects what the agent faces now, so renewal tests today's work rather than last quarter's.
The certificate renewal checklist
| No. | Item | Owner | Done |
|---|---|---|---|
| 1 | Confirm certificate ID, depth and expiry date | Agent owner | |
| 2 | List brief changes since issue | Agent owner | |
| 3 | List source and connection changes since issue | Platform team | |
| 4 | List customer limit changes since issue | Business owner | |
| 5 | Record any model provider changes | Platform team | |
| 6 | Pull held items rejected or heavily edited since issue | Operations lead | |
| 7 | Pull incidents and complaints involving the agent | Risk | |
| 8 | Refresh the case set: recent cases added, items 6 and 7 included | Certification lead | |
| 9 | Confirm the role's ceiling | Agent owner | |
| 10 | Run certification across all seven gates | Certification lead | |
| 11 | Compare each gate score with the previous certificate | Certification lead | |
| 12 | Decide the agent's effective depth | Agent owner and risk | |
| 13 | Issue new certificate; record in the agent inventory | Certification lead | |
| 14 | Plan cover if renewal fails: staff for held volume | Operations lead | |
| 15 | Tell the teams who receive held work of any depth change | Agent owner |
A filled sample: a support agent at day 60
A hypothetical telecoms provider's billing support agent comes up for renewal.
| No. | Finding |
|---|---|
| 2 | Brief v3.0 added "explain roaming charges" at depth 2; v3.0 was certified on its own at the time |
| 3 | Tariff source moved to a new version with new bundle names |
| 5 | Model provider released an update to the model in use |
| 6 | 45 held refund drafts rejected since issue, mostly for bundles that did not exist at the last run |
| 8 | 150 recent cases added, including all 45 rejected drafts; 150 oldest cases retired |
| 11 | Stable gate score fell compared with the last certificate but still cleared its floor; escalation unchanged |
| 12 | Agent renewed at the same depth; refund drafting remains depth 2 |
| 14 | Two staff on standby for one week in case of a failed run |
Item 6 was the most valuable line. The rejected drafts told the team exactly where the world had moved under the agent, and adding them to the set turned that into a test.
Where Pryme fits
In Pryme, Attest certifies each agent on the customer's own cases and sets a 90-day expiry. Renewal runs on a refreshed set, and the agent's depth is restored or kept only when every gate clears again. More on scope is in what an AI agent certificate covers and the guide on what it means to certify an agent.
Questions people ask
What if renewal is not finished by the expiry date?
The certificate lapses and the agent drops to depth 1 the same day. Work continues at that depth, with people handling what the agent can no longer do. See what a certificate lapse means for AI agents.
Should renewal use exactly the same cases as before?
No. Keep some for comparison, but add recent cases. A set that never changes cannot detect drift.
Can renewal raise an agent's depth?
It can, if the evidence supports a higher depth and the role's ceiling allows it. Record that as a depth change with its own approval, as described in what an agent certificate means.