Bring the committee a decision it can actually make. That means one narrow job, a list of every action the agent can take with the limit on each, evidence from testing on the bank's own cases, a named owner, and a plan for switching it off. Committees reject vague proposals far more often than they reject agents.
Why do risk committees say no?
Usually because the paper asks them to approve something they cannot see the edges of. "An AI assistant for operations" invites every question at once: what can it touch, who checks it, what happens when it is wrong. A committee that cannot answer those questions defers.
The fix is to shrink the request. One process, one team, a short list of actions, and a clear statement of what the agent will not do. A committee can weigh that. It is the same discipline described in how to get risk and compliance to approve an AI agent, applied to the more formal setting of a bank's risk governance.
What steps lead to approval?
- Pick a job with visible output and low reversal cost. Payment investigations, complaint drafting and KYC file preparation work well. Avoid credit decisions and anything that moves money as a first request.
- List every capability. Each action the agent can take, which system it touches and how far it may go: read, draft, execute routine work within bounds, or move money.
- Classify the agent for model risk. Decide with the model risk team whether it sits in the model inventory. In most banks it will. See whether an AI agent is a model under bank model risk rules.
- Test on the bank's own cases. Replay past cases with known outcomes, score each capability separately, and include hard and rare cases.
- Get independent challenge. The validation function reviews the design and the results, adds its own cases and records its findings.
- Name the owner. One accountable person in the business, plus the operational owner who watches it day to day.
- Write the exit plan. How the agent is stopped, how work returns to people, and how long that takes.
- Propose limits and a review date. Start narrower than the evidence allows, with a date to revisit.
What should the committee paper contain?
Keep it short and concrete. A committee reads a page of facts more readily than ten pages of description.
| Section | What it shows |
|---|---|
| The job | The process, the team, the volume, what changes for staff |
| Capabilities and limits | A table of actions, each with its depth and limit |
| What stays with people | Decisions the agent prepares but never makes |
| Test evidence | Scores per capability on the bank's own cases, with failures listed |
| Validation findings | Independent review, open issues and how they were closed |
| Controls | How limits are enforced at the moment of action, and what is recorded |
| Risks and residual risk | What could still go wrong and how it would be caught |
| Exit plan | How to switch it off and take the work back |
| Owner and review date | Named people and the next checkpoint |
Agents can help prepare this paper too; how to prepare compliance committee papers with an AI agent covers the drafting side.
What does the committee keep for itself?
Approval is the committee's decision, and so are the terms around it. It sets the risk appetite the agent must sit within, decides which actions need a person, sets the review cycle, and decides what evidence would trigger a pause. It should also decide who may raise the agent's limits later. That should not be the team that built it.
An illustrative example
A regional bank wants an agent to check departmental spend against approved budgets and flag overruns for finance business partners. The first paper asked for an agent that could "review and approve purchase requests". The committee deferred it.
The second paper narrowed the job. The agent reads purchase requests, compares them with the approved budget lines, and drafts a note to the budget holder for anything over a threshold. It approves nothing. Testing on a quarter of past requests showed which overruns it caught and which it missed. The committee approved it with a three-month review, and the process is described in how to check spend against approved budgets with an AI agent.
What controls make the committee comfortable?
- Limits enforced outside the agent, at the moment it acts, not in its instructions.
- A record of every verdict, including refusals and holds, that the committee can sample.
- Automatic step-down when a test fails or overrides rise, without waiting for the next meeting.
- Expiry. Authority lapses unless it is renewed on fresh evidence.
- Clear reporting to the committee on volumes, holds, overrides and incidents.
Model risk teams will frame much of this in their own terms; what model risk management is gives the vocabulary. The wider limits are in AI agents in banking: what they may and may not do.
Questions people ask
Should the vendor present to the committee?
The bank's own owner should present. The committee is approving the bank's use of the agent, and it needs to hear from the person who will answer for it.
Can approval be granted for a pilot only?
Yes, and that is often wise. A pilot with a small team, low limits and a fixed end date gives the committee real evidence for the full decision.
What if the committee asks for something the agent cannot show?
Say so and propose how to get it. A gap stated plainly, with a plan, builds more confidence than an answer stretched to fit.