How to keep risk managers ready for an AI agent’s 90-day recertification

Risk managers stay ready by updating each agent's risk assessment every cycle, not once a year. Every 90 days an agent's certificate lapses unless renewed on the organisation's own cases, and each renewal can change depth, scope and sources. The risk manager reads the results, checks them against appetite, adjusts the organisation's own limits and keeps the indicators that warn between cycles.

What does each recertification mean for a risk manager?

Recertification produces fresh evidence about each agent: which cases were replayed, how each of seven gates scored, and what depth the evidence supports. The agent's role sets a ceiling and the evidence sets the depth; the lower wins. The risk manager adds the third control: the organisation's own limits, which can narrow any agent further at any time.

That makes the risk manager the person who answers one question each cycle: given this evidence, is this depth within appetite? An agent that earns depth 4 on strong evidence may still be capped at depth 3 by limits if the organisation's tolerance for hard-to-undo errors in that area is low.

For example, an agent that releases supplier payments might clear every gate for depth 4 on payments up to 10,000. If the board's appetite says no single automated payment above 2,500 without a person, the risk manager sets that as an organisation limit. Payments between the two amounts are refused, the verdict names the limit as the deciding bound, and the record shows the choice was deliberate.

Risk managers use agents too. A risk agent compiles key risk indicators from the record at depth 1: refusals by deciding bound, held items by age, failed runs. It drafts updates to each AI risk assessment at depth 2. The risk manager owns the assessment and the rating. A primer on the cycle is in what recertification is.

Who owns what?

The risk manager owns the AI risk assessment per agent, the appetite statements behind depth, and the organisation's own limits where they are set for risk reasons. Builders own recertification. Business owners own day-to-day operation. Compliance and internal audit review independently.

Steps for each cycle

1. Agent, depth 1: compile indicators for each agent due: failed runs, refusals by bound, held item ages, edits to drafts, incidents.
2. Person (risk manager): set the questions for the builder: which risks the replay must test, drawn from incidents and indicators.
3. Person (builder): recertify and share gate results.
4. Person (risk manager): compare evidence to appetite for each agent that changed depth.
5. Person (risk manager): adjust limits where depth exceeds appetite, and record why.
6. Agent, depth 2: draft the updated risk assessment for each agent.
7. Person (risk manager): edit and approve the assessment and report changes to the risk committee.
8. Person (risk manager): confirm business owners briefed their teams, because a control people do not understand is weaker than it looks.

What should risk managers keep relearning?

Gate results. Grounded, refusal, depth, escalation, scope, adversarial and stable each clear on their own. A narrow pass on the stable gate is an early warning; a narrow pass on the adversarial gate needs a conversation the same day.

The minimum chain. Each action meets five bounds at once: role scope, certificate, sources, the organisation's own limits and the platform guardrails. The verdict names which bound decided. Indicators built on that field show which control is doing the work.

Refused and withheld. Customers narrow agents with their own limits, which produce refusals or holds. Only the platform floor withholds. Risk managers should not write remediation that asks the platform to withhold something; they should set a limit.

Frameworks. The NIST AI Risk Management Framework organises work into Govern, Map, Measure and Manage, and ISO/IEC 23894 gives guidance on AI risk management. Each 90-day cycle is a natural Measure and Manage step.

Controls and the evidence they leave

• Replay questions set by risk. Evidence: the question list given to the builder.
• Appetite check per agent. Evidence: the risk manager's decision and reason.
• Limit changes. Evidence: dated limit history with names.
• Updated risk assessment per agent per cycle. Evidence: the approved assessment.
• Practicum for risk managers who approve. Evidence: the practicum log template for risk managers.

What to measure

Agents whose depth was capped by limits for appetite reasons. Failed runs per cycle across the estate. The time from an incident to its inclusion in the next replay. And indicators that crossed a threshold between cycles, with what was done. If incidents are not reaching the replay, the cycle is testing the past.

Where does it go wrong?

Risk sees results after the new certificate is live. Challenge becomes clean-up. Put the review before the effective date.

The risk assessment is annual. An assessment written a year ago describes an agent that has been recertified four times since. Update it every cycle, even if only to confirm nothing changed.

Limits are set and forgotten. A cap applied for appetite reasons should be reviewed every cycle against new evidence. Operations and property teams depend on these limits; compare keeping operations managers ready and keeping property managers ready for recertification.

Where the Academy fits

Pryme Intelligence Academy's Architect track is written for people who lead regulated, multi-agent deployments, and ends with a capstone and a board review with two Pryme assessors; Certified Pryme Architect is valid 24 months. Risk managers closer to daily operations may start with the Operator track. More in the guide to AI literacy and certification for people who work with agents.