Effectively, yes. PRA SS1/23 sets model risk management principles for banks and uses a broad idea of what a model is. An AI agent runs on a model and its outputs inform decisions, so it belongs in the bank's model inventory, tiered, validated and monitored. What SS1/23 does not do is tell you how to bound an agent's actions.
What does SS1/23 require, in substance?
SS1/23 is the PRA's supervisory statement on model risk management for banks. Its expectations are proportionate to the bank's size and its reliance on models. In substance it asks banks to:
- Identify and classify models: keep a complete inventory and tier each model by its materiality and complexity.
- Govern model risk: set a framework approved at board level, with clear senior accountability for it.
- Develop, implement and use models with discipline: documented purpose, data, assumptions and limitations; testing before use; use within the purpose tested.
- Validate independently: review by people independent of development, before use and periodically, with ongoing performance monitoring.
- Mitigate model risk: apply restrictions, adjustments or extra review where a model's limitations or uncertainty call for it.
How each principle translates to agents is worked through in PRA SS1/23 model risk management for AI agents.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Why is an agent harder to fit than a traditional model?
A credit scorecard takes defined inputs and returns a score. Its validation tests the score. An agent takes open inputs, reads documents, chooses tools and acts. Three things follow.
The thing to validate is bigger. The underlying model is only one part. The agent's instructions, sources, tools and limits shape its outputs as much as the model does. Validating the model alone leaves most of the risk untested.
Use can drift without a change request. A model provider updates the model; a team adds a source; the agent's behaviour shifts. SS1/23's expectation that models are used within their tested purpose needs a way to detect this.
Outputs are actions. A scorecard's error is a wrong number someone acts on. An agent's error can be the action itself, which raises the agent's tier and the strength of mitigants needed. The broader argument is made in model risk rules already cover AI agents.
What may the agent do, and what stays with a person?
| Agent capability | Likely tier | Mitigant under SS1/23 | Stays with a person |
|---|---|---|---|
| Summarise credit files for analysts | Lower | Sample review | The credit judgement |
| Recommend provisioning adjustments | Higher | Independent validation; held output | Approval of any adjustment |
| Classify transactions for regulatory reporting | Higher | Reconciliation checks | Sign-off of the return |
| Execute routine account changes | Depends on value | Limits and monitoring | Exceptions above limits |
An illustrative example
Take a UK mid-tier bank that uses an agent to draft expected credit loss overlays for its mortgage book. The agent reads arrears data, macro scenarios and analysts' notes, and proposes an overlay with reasoning. The bank's model inventory listed the underlying model provider's model but not the agent.
The model risk team adds the agent as its own entry, tiered high because its output feeds the financial statements. Validation tests the whole agent on past quarters: whether its proposed overlays are grounded in the data it read, how it handles missing scenarios, and whether it stays consistent across runs. As a mitigant, every overlay is held for approval by the credit risk committee, and any change to the agent's sources or model triggers revalidation. The approach to that testing is set out in PRA SS1/23 model validation for AI agents.
Which controls meet SS1/23 for agents?
- Inventory each agent, not just its model, with purpose, sources, tools and owner.
- Tier by the action, so agents that act directly on customers or financial records rank higher.
- Validate the whole agent on the bank's own historical cases, by people independent of the build.
- Monitor in use, including detection of model, source or behaviour changes.
- Restrict use to the purposes validated, enforced at the moment of action.
- Record mitigants, such as holds and limits, in the model record.
Canadian banks face a similar framework, described in how OSFI E-23 applies to AI agents. The cross-regulation map is in AI agent regulation, mapped to controls.
Where Pryme fits
Attest replays an agent against the bank's own past cases and scores each answer against seven gates, which gives model validation evidence for the whole agent rather than the model alone. Certificates lapse after 90 days, and a failed run drops the agent to read-only the same day.
Questions people ask
Do we need to validate the model provider's model ourselves?
You need enough evidence to rely on it, but the provider's model is usually validated as part of the agent. Test what the bank uses: the agent doing its job on your cases.
Who is accountable for agent model risk?
SS1/23 expects clear senior accountability for the model risk framework. Under the senior managers regime, that accountability should be explicit, and the agent's business owner should be named too.
Are agents that only draft text in scope?
If the text informs decisions, such as credit or risk judgements, treat the agent as a model. Agents that draft routine correspondence may be tiered low or recorded as tools.