How to roll out AI agent training across a bank

A bank should roll out AI agent training one business line at a time. Start with the accountable executive and first-line reviewers of the line going live, train second-line risk in parallel, and train builders before any agent is certified. Each line goes live only when its reviewers hold current certificates the bank can show a supervisor.

Why does a bank need a different rollout from other firms?

Three things set banks apart. Accountability is personal: in many markets a named senior manager answers for each area, as under the UK's Senior Managers and Certification Regime. Model risk is supervised in most banking markets, so supervisors expect the bank to show who validated what. And the agents touch money: payments, lending decisions and account changes sit at depth 3 or 4, where errors are hard to undo.

So the rollout is built around business lines, each with its own accountable executive, reviewers and controls. The head of operational change usually owns the plan; each line's executive owns go-live for that line. If your agents will spread gradually across lines, the pattern in how to roll out an AI agent gradually fits alongside this one.

The rollout, line by line

1. Twelve weeks before the first line. Person (head of change): runs a readiness assessment for that line. Reviewers, team leaders and the accountable executive take a short test on the core ideas, set in banking. The results show gaps by concept, such as many people confusing refused with withheld.
2. Ten weeks before. Accountable executive and senior management: foundations training. They must understand depth, the minimum chain, the four verdicts and the append-only record well enough to answer a supervisor's questions themselves.
3. Ten to three weeks before. First-line reviewers: operator-level training. These are the people who will approve held payments, held account changes or held lending decisions. They learn to read provenance (a ledger entry is sealed; a customer's claim is declared; an emailed instruction is external and cannot authorise a payment) and to spot when a draft rests on weak facts.
4. Same window. Second line and model validation: foundations, plus a deeper programme for the risk lead. Second line must be able to read Attest results, gate by gate, and test whether the bank's own limits match its risk appetite.
5. Before certification. Builders: builder-level training. Whoever designs and certifies agents must do so on the bank's own cases, not on vendor demonstrations.
6. Go-live. Agent, depth 1 then 2: drafts for the first line's queue. Every draft is held for a certified reviewer. Depth 3 or 4 is earned only after Attest evidence and a period of reviewed decisions.
7. Four weeks after. Person (accountable executive): reviews proof of completion and the record, then signs off the next line's start.

How do you time training against go-live?

Train reviewers close to go-live, not months ahead. Skills fade if people learn on practice cases in spring and see their first real held payment in autumn. Three to six weeks between operator training and go-live works for most lines.

Avoid launching a line in a peak period such as quarter-end, payroll weeks for business banking, or a major system change. Also plan around agent recertification: certificates lapse after 90 days, and a run that clears no depth drops the agent to depth 1 the same day. Reviewers trained for a draft-only queue cope with that; reviewers who only ever saw depth 3 may not.

For banks with operations in several countries, the same tracks apply but red lines and regulators differ; see how to train a team across several countries to oversee AI agents.

What counts as proof of completion?

A supervisor will want more than an attendance list. Useful proof:

• Certificates that can be checked at source, showing credential, issue date and expiry, and showing clearly if one has lapsed or been revoked.
• Approval rights tied to current certificates. A bank can adopt a rule that a person may approve a depth 3 or depth 4 action only while their certificate is current. The workspace then refuses approvals that break the rule, and the verdict says why.
• The record. Every approval names a person, so the bank can show a trained reviewer approved each payment.
• Internal checks. Some banks keep an internal question bank for short refresher tests between renewals.

Where the bank is in scope of the EU AI Act, Article 4 asks providers and deployers to take measures for AI literacy, and Article 14 sets human oversight duties for high-risk systems. In the EU, DORA adds ICT risk and resilience testing duties. This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

What should the head of change measure?

• Readiness scores by concept, per line, before and after training.
• Reviewer decisions overturned on second-line sampling.
• Approvals refused because the reviewer's certificate had lapsed. Any at all means renewal planning is behind.
• Held items waiting because no certified reviewer was on shift.

Where do bank rollouts go wrong?

One programme for everyone. A single e-learning module for the whole bank satisfies an attendance target and leaves reviewers unready for real held payments.

Second line trained after go-live. If risk cannot read Attest evidence on day one, the first challenge comes after an incident instead of before it.

Contact centres forgotten. Customers ask the contact centre about decisions agents made. Banks with large centres should align with the contact centre rollout. Smaller, faster firms face different trade-offs; compare the fintech rollout. The full method is in training teams for AI agents.

Where the Academy fits

Pryme Intelligence Academy runs four tracks that match a bank's layers: Foundations for executives, Operator for reviewers, Builder for agent designers, and Architect, valid for 24 months, for people leading regulated multi-agent deployments. Certificates are issued through VerifyDoc.ai, a public register lists certified people, and an admin view shows expiry dates across the team.