Compliance officers stay ready by reading each recertification as a control change and challenging it before it takes effect. Every 90 days, each agent is re-scored on the firm's own cases, gate by gate. The officer needs to read those results, test whether depth changes fit the firm's risk appetite, and confirm the people overseeing the agent were briefed.
What does recertification mean for a compliance officer?
For most staff, recertification changes their queue. For a compliance officer it changes the control environment. An agent's certificate lapses after 90 days. Recertification replays the agent against real cases from the firm's operation and scores it against seven gates, each of which must clear on its own: grounded, refuses, depth, escalates, scope, adversarial and stable. The depth the agent earns is the lower of what the evidence supports and its role's ceiling.
That gives the compliance officer three questions per cycle. Did any agent move up a depth, and is the firm comfortable with that? Did any gate pass narrowly, suggesting a risk the next cycle may not catch? And did the people who approve held actions get told what changed?
Compliance officers also use agents themselves. A monitoring agent may read transactions or communications at depth 1, draft monitoring reports and breach logs at depth 2, and map regulatory updates to policies as drafts. None of it files a regulatory notification or closes a breach. More on the mechanism is in what recertification is.
Who owns what in the cycle?
The compliance officer owns challenge and sign-off for depth increases in regulated activities. The builder owns the recertification. Business owners own the firm's own limits and staff readiness. Under the UK's Senior Managers and Certification Regime, named individuals are accountable for areas of the business, and the compliance officer should know which senior manager answers for each agent's area.
The steps
- Agent, depth 1: compile the cycle summary across all agents in scope: capabilities, current depth, expiry, verdict counts and the bound that decided refusals and holds.
- Person (compliance officer): set the review list. Any agent seeking a higher depth, any capability in a regulated activity, any that failed last time.
- Person (builder): recertify and share gate results for each agent on the list.
- Person (compliance officer): challenge. For each depth increase, ask which cases proved it, how many were hard cases, and what the escalation results showed.
- Agent, depth 2: draft the oversight memo summarising results, changes and open questions.
- Person (compliance officer): edit and sign the memo, approving, deferring or conditioning each increase.
- Person (business owners): brief their teams using the signed change note.
- Person (compliance officer): sample held actions cleared in the first fortnight and check approvers held current certificates.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Cycle summary | Compiles certificates, verdicts and deciding bounds | 1 | Choosing what to review |
| Gate results | Is replayed on real cases | n/a | Interpreting results |
| Oversight memo | Drafts the memo | 2 | Sign-off and conditions |
| Monitoring | Reads activity and drafts breach logs | 1 and 2 | Confirming any breach |
| Regulatory mapping | Drafts policy impacts | 2 | Deciding policy changes |
| Post-cycle sample | Lists held actions and approvers | 1 | Judging adequacy |
What should compliance officers keep relearning?
Reading gate results. A pass on the refusal gate means the agent refused what it should. A narrow pass on the stable gate means behaviour is moving. Officers should be able to explain both to a board.
Refused versus withheld. A refusal is the firm's own bounds or the agent's certificate at work and can be changed by the firm. A withheld action is refused at the platform floor for every agent at every depth, such as reversing a settled payment on the platform's own rail. Firms narrow agents through their own limits; only the platform withholds. An officer who confuses the two will write the wrong remediation.
Provenance. Facts reach agents as sealed, signed, declared or external. An external claim, such as an emailed instruction, cannot authorise a payment. Officers should test that the firm's own limits reflect this.
Literacy duties. Under the EU AI Act, Article 4 expects providers and deployers to ensure sufficient AI literacy among staff dealing with AI systems, and Article 14 covers human oversight. The officer should see each cycle's briefing as evidence of both. Pryme Intelligence Academy's Operator and Architect tracks are one way to give that evidence a checkable certificate.
Controls and the evidence they leave
- Signed oversight memo per cycle. Evidence: the memo with decisions on each depth change.
- Conditional approvals. Evidence: conditions recorded and checked at the next cycle.
- Approver certificate check. Evidence: a dated check of approvers' certificate status at source.
- Post-cycle sample. Evidence: the sample and findings.
- Practicum records for officers who approve. Evidence: the practicum log template for compliance officers.
What to measure
Count depth increases approved, deferred and conditioned per cycle. Track how many conditions were met by the next cycle. Track approvals made by staff without a current certificate, which should be zero. And track how many findings from the post-cycle sample repeat across cycles; repeats mean the briefing is not landing.
Where does it go wrong?
The officer sees results only after the new certificate is live. Challenge after the fact becomes remediation. Put the review before the effective date.
The memo describes the agent and ignores the people. A depth increase is only safe if the people who now read exceptions know how. Ask for the briefing evidence.
Accountability blurs. The officer oversees but does not run the agent, a line drawn in are compliance officers accountable for an AI agent's mistakes. Lending and procurement teams follow similar cycles; compare keeping loan officers ready and the guide to AI literacy and certification for people who work with agents.
Questions people ask
Should compliance sign off every recertification?
Every depth increase in a regulated activity, yes. Renewals at the same depth with clean results can be noted rather than signed, if the firm's policy says so.
Can compliance lower an agent's depth?
The firm can narrow any agent through its own limits at any time. That is often the right response to a narrow pass while evidence builds.
How much technical knowledge does an officer need?
Enough to read gate results, the deciding bound on a verdict and the record. Model internals are not required.