How to onboard a new compliance officer to an AI agent workspace

A compliance officer joining a firm where agents already work should spend week one learning what each agent may do and reading the record of what it did, and week two testing the controls: red lines, held actions, certificates and approvers. By the end, they can answer a supervisor's question about any agent from evidence.

What is different about compliance in an agent workspace?

Compliance officers have always tested whether people follow rules. With agents, they also test whether the bounds on each agent express those rules, whether the agent is certified to act at the depth it is acting at, and whether the people approving its held actions are competent. The record makes this testable. Every verdict an agent produces, allowed, held, refused or withheld, is filed in an append-only record that names which bound decided.

That changes where a new officer looks first. Policies and procedures still matter, but the agent register and the record are where rules meet action. Whether agents could do the officer's own job is discussed in can an AI agent replace a compliance officer; the short answer is no, but they change what the job is. How the day changes is in what changes in a compliance officer's day when AI agents arrive. The head of compliance owns onboarding.

What does the two-week plan look like?

1. Day 1. Person (head of compliance): hands over the agent register: each agent, its owner, its certified depth, its certificate status and the customer limits that bind it.
2. Day 1 to 2. Agent, depth 1: summarises the record for each agent over the last quarter: verdicts by type, held actions and who approved them, refusals by bound, and any falls to depth 1 after a lapse or a run that cleared no depth.
3. Day 3 to 4. Person (new officer): meets each agent owner and asks three questions: what is this agent not allowed to do, how do you know, and when was it last re-certified?
4. Day 5. Person (new officer): reads the regulatory map for the agents in scope, with the head of compliance, so they know which obligations apply where.
5. Week 2. Person (new officer): tests red lines. For two or three agents, pick a rule that must never be broken and find evidence in the record that it was held or refused when it should have been.
6. Week 2. Person (new officer): checks approver competence: who approved high-depth held actions, and did they hold a current certificate at the time?
7. End of week 2. Person (head of compliance): reviews the officer's findings and assigns ongoing monitoring.

Which regulations will the officer meet most?

It depends on the firm and market. In the EU, the AI Act places duties on deployers of high-risk systems, including human oversight and keeping logs, and requires AI literacy measures for staff. GDPR Article 22 restricts decisions based solely on automated processing with legal or similarly significant effects. In financial services, DORA covers ICT risk and third-party risk, and supervisors in many banking markets expect model risk management. In the UK, the FCA's Consumer Duty expects good outcomes for retail customers, and the Senior Managers and Certification Regime ties accountability to named people. A new officer should map which of these apply to which agent in week one.

What must the officer learn to tell apart?

Refused and withheld. A refusal means the agent's bounds, often the firm's own limits, stopped the action. Withheld means the platform itself withholds the action for every agent at every depth. If the firm wants something stopped, the control is the firm's own limit, and the officer should check that it exists, not assume the platform will catch it.

Agent certificates and people's certificates. An agent's certificate lapses after 90 days. People's training certificates last longer, typically 12 or 24 months. Both appear in evidence, and both can lapse unnoticed.

Which controls and evidence should onboarding leave?

• A reviewed register. Evidence: the officer's annotated copy.
• Red-line tests. Evidence: cases retrieved and the officer's conclusion.
• Approver competence check. Evidence: approvers matched to certificates at the date of approval.
• A monitoring plan. Evidence: the approved schedule.

What should a compliance officer measure from then on?

Held actions approved by people without a current certificate. Agents acting with lapsed certificates, which should be none. Loosening changes to bounds and who approved them. Red-line tests repeated quarterly. And time from a regulatory change to the corresponding change in agent bounds or sources.

Where does it usually go wrong?

Starting from policy documents. A new officer reads every policy before looking at what the agents actually do, and finds the gaps months later.

Trusting the register. Registers go stale. Check it against the record.

Becoming the agent owner's editor. Compliance should challenge and test, not rewrite briefs. The training these officers themselves need is described in what is compliance training, and colleagues joining nearby roles follow parallel plans, such as a new loan officer and a new procurement officer. The wider approach is in training teams for AI agents.