Usually, yes. Bank model risk rules define a model by what it does, not how it is built: it takes inputs, applies a method and produces outputs the bank relies on. An agent whose outputs inform or make decisions fits. The open questions are how material it is, and whether the whole agent or only its model is in scope.
What decides whether an agent counts as a model?
Supervisors in most banking markets frame model risk in substance. A method that processes inputs into outputs people rely on for decisions is treated as a model, and the bank is expected to keep an inventory, validate before use and monitor afterwards. In the US the reference is SR 11-7; in the UK, PRA SS1/23; in Canada, OSFI Guideline E-23. What model risk management is covers the shared vocabulary.
For an agent, ask three questions:
- Does its output feed a decision? A draft complaint response a handler sends, a risk summary an analyst relies on, a payment it releases. If yes, it is likely a model.
- Is the process material? Customer outcomes, financial reporting, regulatory reporting and financial crime are material. An agent that tidies internal meeting notes may not be.
- Would an error be costly or hard to detect? Agents act quickly and at volume, which makes undetected errors more costly than a person's occasional slip.
The argument that existing rules already reach agents, without waiting for new ones, is made in model risk rules already cover AI agents.
Is it the model or the agent that goes in the inventory?
The agent. Listing only the underlying language model misses most of what drives behaviour. The same model can behave very differently depending on the brief it is given, the sources it reads, the tools it can call and the limits on each.
A sound inventory entry for an agent records:
| Field | Why it matters |
|---|---|
| Purpose and process | Sets materiality and the validation depth |
| Underlying model and version | A model update can change behaviour |
| Brief and instructions | Changing the brief changes the agent |
| Sources | New or changed sources change what it knows |
| Tools and limits per capability | Defines what it can actually do |
| Depth (per agent), and the depth each action needs | Read, draft, execute or move money |
| Owner and validator | Named accountability |
| Last validation and next review | Shows the evidence is current |
What changes when the "model" acts?
Classic model risk work assumes a person reads the output and decides. An agent may act on its own output. That moves some of the risk from "is the estimate right?" to "was the action allowed?", which validation must cover too.
So the validation for an agent adds checks that a credit scorecard never needed: does it refuse what it should, escalate when it should, stay within its role, and stay within its permitted depth for each action? What model validation is explains the core discipline; agents extend it to behaviour as well as accuracy.
Which steps stay with a named person?
Model risk rules are built on named accountability, and agents do not change that.
- The model owner in the business answers for the agent's use and its limits.
- The validator, independent of the builders, decides whether the evidence supports approval.
- The inventory decision, in or out and at what materiality tier, is made and recorded by the model risk function.
- Approval for use sits with the governance forum the bank has set, often a risk committee; see how to get an AI agent approved by a bank's risk committee.
- Raising an agent's limits is a change requiring the same approvals, not a configuration tweak.
An illustrative example
A bank uses an agent to draft summaries of commercial borrowers' annual accounts for credit analysts. The team that built it argues it is "just a summariser" and not a model.
The model risk function disagrees. The summaries feed credit decisions, analysts rely on the figures, and an error could misstate a borrower's leverage. The agent is added to the inventory at a moderate tier. Validation tests it on past borrower files, checks every figure is traced to the accounts, and confirms it flags missing statements rather than estimating them. A second agent at the same bank that formats internal meeting minutes is recorded as out of scope, with the reason noted.
Where Pryme fits
Pryme gives the model risk function the evidence an inventory entry needs. Attest replays the agent against the bank's own cases and scores seven gates separately. Each certificate lapses after 90 days, and a run that clears no depth drops the agent to depth 1 the same day. A full treatment against US guidance is in SR 11-7 model risk management for AI agents.
Questions people ask
Does a low-risk agent still need an inventory entry?
It needs a recorded decision. Logging an agent as out of scope, with the reason, is part of the inventory discipline and protects the bank if the agent's use later grows.
Who decides the materiality tier?
The model risk function, with input from the business owner. The tier sets how deep validation goes and how often it repeats.
Do these rules apply outside banking?
Bank model risk rules apply to banks. Insurers, investment firms and others have their own governance expectations, and many apply similar thinking. The wider limits for banks are in AI agents in banking: what they may and may not do.