The UK regulates AI through existing regulators rather than one AI law, so an AI governance analyst here translates FCA, PRA and ICO expectations into checks on each AI agent. Roles sit in banks, insurers, lenders, payment firms and the public sector. Show control experience, Consumer Duty fluency and a certificate employers can check.
What does the work look like in the UK today?
UK financial firms already carry a heavy governance load. Consumer Duty asks them to evidence good outcomes for retail customers. The Senior Managers and Certification Regime names the individuals accountable for each area. Banks apply model risk principles. Into that structure come agents that draft letters, update accounts and prepare payments.
The question every board now asks is "who answers for this agent, and how would we know if it went wrong?" An AI governance analyst builds the answer: a register of agents, the authority each holds, the evidence behind it, the senior manager accountable, and the management information that shows outcomes. London holds most roles, with significant financial centres in Edinburgh, Leeds, Manchester, Birmingham, Cardiff and Bristol.
Where are agents being used, and at what depth?
A UK consumer lender is a good example because the outcomes are visible:
- Income and expenditure review (depth 1). The agent reads a customer's submitted figures and bank data and lists inconsistencies.
- Forbearance letters (depth 2). It drafts the letter offering a payment plan; a collections specialist checks tone and sends it.
- Routine payment date changes (depth 3). Within limits the lender sets, filed automatically.
- Refunds and write-offs (depth 4). Held for a named person.
Governance here is about outcomes as much as controls. Under Consumer Duty, a lender must show that customers in financial difficulty are treated well. The analyst therefore reviews not just whether an agent's verdicts are filed, but whether held items for vulnerable customers are reaching the right person quickly. Certificates lapse after 90 days, and a run that clears no depth drops the agent to depth 1 the same day, so the register is a live document.
Which UK roles can you aim for?
UK adverts use many titles for related work:
- AI governance analyst or manager: register, policy mapping, board reporting.
- AI risk analyst (second line): challenge of each deployment.
- Model risk analyst: validation, increasingly including agents.
- Consumer Duty analyst: outcome testing, now covering agent-drafted communications.
- Data protection analyst: impact assessments under UK GDPR.
Read the duties for oversight, outcome testing, approvals, escalation and evidence. What an AI governance analyst does sets out the week, and AI agent jobs and careers maps the wider family.
What skills do UK employers want, and how do you show them?
UK hiring managers want three things. Regulatory literacy: you can say which regulator cares about a given agent action and why. Evidence discipline: you can show a decision trail that would satisfy an auditor. And practical judgement: you can tell when an agent's depth is supported and when it is not.
People from compliance often make the move with little retraining; moving from compliance into AI governance sets out which of your skills transfer. Others come from operations or audit. Whichever you are, write a two-page CV that leads with control outcomes. The AI governance analyst CV template shows how to list a certificate by number so it can be checked. A credential such as Certified Pryme Operator from Pryme Intelligence Academy adds evidence that you have made real review decisions under assessment.
Which UK rules shape oversight work?
The FCA supervises conduct. Its Consumer Duty requires firms to deliver good outcomes for retail customers and to evidence them, which extends to communications an agent drafts and decisions it prepares. The PRA, part of the Bank of England, supervises banks and insurers for safety and soundness; its SS1/23 sets model risk management principles for banks. The Senior Managers and Certification Regime makes named individuals accountable, so every agent capability needs an owner who can answer for it. The PSR oversees payment systems.
The ICO enforces UK GDPR and the Data Protection Act 2018. Article 22 restricts decisions based solely on automated processing with legal or similarly significant effects, and Article 35 requires an impact assessment for high-risk processing. The UK takes a principles-based, regulator-led approach to AI rather than a single AI law. Firms serving EU customers may also meet the EU AI Act.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What is a 90-day plan to get hired?
- Days 1 to 20. Read what an AI governance analyst is. Learn depth, verdicts and provenance. List the controls you own today.
- Days 21 to 50. Write a two-page review of an invented lender's collections agent, mapped to Consumer Duty, SM&CR and UK GDPR.
- Days 51 to 70. Earn a certificate that includes a practicum of real review decisions. Update your CV and LinkedIn.
- Days 71 to 90. Apply by duties. Ask your own firm's risk function whether it keeps an agent register. Internal moves are often the quickest route.
Questions people ask
Do I need to be approved under SM&CR to work in AI governance?
Most governance analysts are not senior managers and do not hold a senior management function. Some roles fall under the Certification Regime; the advert or employer will say. A professional certificate is not the same thing as regulatory approval.
Is London the only option?
No. Many banks, insurers and lenders run governance teams in Edinburgh, Leeds, Manchester, Cardiff and Bristol, and hybrid working is common.
Should I start with the full certification path?
Only if you are sure. If you are new to agents, a free foundations-level badge is a sensible start, and you can decide on the professional certificate once you know the work suits you.