About two months for a risk manager, and longer for whoever leads risk across a regulated, multi-agent deployment. The core is roughly 18 hours of learning, two weeks of supervised decisions on live work and an exam. The extra time goes on what risk managers own: limits, evidence for depth changes and the reading of the record.
What a risk manager supervises
Risk managers sit in the second line. They rarely decide individual held actions. They decide whether the arrangement around the agent is sound: whether the business's own limits match its risk appetite, whether the evidence behind each depth is strong enough, whether certificates are current, and whether the record shows the agent behaving as intended.
Their training therefore leans toward evidence. A risk manager should be able to read a certification result and see which of the seven gates were close to their floor: grounded, refuses, depth, escalates, scope, adversarial and stable. They should know that depth is earned, that the role sets a ceiling, that evidence sets the depth, and that the lower wins.
How the two months are spent
| Weeks | Stage | Risk-specific focus |
|---|---|---|
| 1 to 2 | Foundations, about 4 hours | Governance, depth and certification, ownership, data and trust |
| 1 to 5 | Operator learning, about 14 hours | How a governed agent decides, reading the workspace, when something goes wrong |
| 4 to 6 | Supervised review | Real held decisions plus weekly sampling of allowed actions |
| 5 to 8 | Limits and evidence review | Review one agent's limits and one depth change with a coach |
| 8 | Exam and sign-off | Written exam and sign-off |
What stays with the risk manager
- Agreeing the business's own limits for each agent, with the operations owner.
- Challenging any proposal to raise depth, on the evidence.
- Setting what is always held, alongside compliance.
- Monitoring certificate lapses and failed runs across agents.
- Reporting agent risk to committees and the board.
Banking supervisors in most markets expect model risk to be managed. In the UK, the PRA's SS1/23 sets model risk management principles for banks; in the US, the interagency guidance SR 11-7 applies; in Canada, OSFI Guideline E-23. Frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 offer structure. A risk manager should be able to map the agent's controls to whichever their business uses.
An illustrative example
Take an insurer's operational risk team of four, overseeing agents in claims and customer service. Risk managers complete Foundations and the Operator modules over five weeks at around three and a half hours a week.
In weeks four to six, each samples fifty allowed actions a week from the claims agent and decides a share of held items. In weeks five to eight, they review a proposal to raise the claims agent from depth 2 to 3 for small settlements. The certification evidence is strong on grounding but close to its floor on escalation. The risk manager asks for more cases with vulnerable customers before agreeing. That challenge, documented, is the kind of judgement the sign-off looks for.
Calibration among risk managers is covered in calibration sessions for risk managers. Requests to relax a limit "temporarily" are a classic pressure tactic; see training risk managers to spot prompt injection and pressure.
How risk compares with operational roles
Operations managers run the rota and billing; risk managers challenge the limits and evidence. Compare how long it takes to train operations managers and the property manager timeline. The overall programme is in training teams for AI agents.
Where the Academy fits
Risk managers start with Foundations and the Operator track of Pryme Intelligence Academy. Whoever leads risk across regulated, multi-agent deployments can take the Architect track, about 30 hours plus a capstone and a board review with two Pryme assessors. It earns Certified Pryme Architect, valid for 24 months.
Questions people ask
Should risk managers be trained before agents go live?
Yes. The limits and depth decisions they own are set before go-live. A risk manager trained afterwards is reviewing choices already made.
Do risk managers need to read the record themselves?
Yes, at least a sample. Dashboards summarise; the record shows which bound decided each verdict and which sources carried it.
How often should risk managers review an agent's limits?
At every depth change, every certificate renewal, and whenever the record shows a pattern of held items that the limits did not anticipate.