PRA SS1/23 sets the model risk principles UK banks are expected to follow, with model owners accountable for each model's use and performance. Where an AI agent is or depends on a model, its owner must be trained to classify its risk, explain its evidence to validators, and use limits on what the agent may do as a mitigant.
What does SS1/23 ask of model owners?
SS1/23 is the PRA's supervisory statement on model risk management for banks. It sets out principles which, in substance, cover:
- Model identification and classification. Firms should define what a model is broadly, keep a complete inventory, and tier models by risk.
- Governance. A board-approved model risk management policy, with a senior manager accountable for the framework under the Senior Managers and Certification Regime, and clear roles for owners, developers, users and validators.
- Development, implementation and use. Models should be fit for purpose, built on suitable data, tested and documented, and used within their intended scope.
- Independent validation. Models should be validated independently, in proportion to their tier, with effective challenge.
- Model risk mitigants. Where a model is weak or uncertain, firms should apply mitigants, such as adjustments to outputs, restrictions on use and closer monitoring.
The PRA expects banks with permission to use internal models for regulatory capital to apply the principles, and other banks to consider them as appropriate. The question of whether SS1/23 covers AI agents has a practical answer: the definition of a model is broad, and an agent that produces estimates or decisions from data, or relies on a model that does, is in scope of the thinking.
Who does it apply to?
UK banks and building societies, with the strongest expectations on those using internal models for capital. Within them, the people involved are model owners, developers, users, independent validators, the model risk function, and the accountable senior manager. The governance side is set out in SS1/23 governance and model risk owners for agents.
What must an agent's model owner understand?
What sits in the inventory. An agent combines a foundation model from a provider, a brief, sources, connections and bounds. Owners must decide with the model risk function which components are inventoried, and treat changes to any of them as changes to the model.
Tiering by capability. Agents act. One capability might read at depth 1; another might move money at depth 4. Tiering should reflect the most consequential capability, and owners must re-tier when capabilities change.
Evidence for validators. Validators need to challenge the model. For an agent, the strongest evidence is how it performed on the bank's own cases. Attest replays the agent against real cases and scores every answer against a floor across seven gates, each of which must clear on its own: grounded, refuses, depth, escalates, scope, adversarial and stable. Owners must be able to present these results, explain failures and accept challenge.
Restrictions on use as a mitigant. SS1/23 treats restrictions on use as a legitimate response to model weakness. For agents, depth is that restriction. Depth is earned, not configured: the agent's role sets the ceiling, certification evidence sets the depth, and the lower wins. An owner who keeps a credit agent at depth 2, so analysts send every decision, is applying a mitigant SS1/23 recognises. Owners should record that reasoning.
Overrides as adjustments. When reviewers change agent outputs, that is the agent equivalent of an adjustment. Owners should track override rates and reasons as a signal of model weakness.
Expiry and drift. Agent certificates lapse after 90 days, and a run that clears no depth drops the agent to depth 1 the same day. Owners must plan recertification and treat drift results as monitoring evidence.
Third-party models. The foundation model comes from a provider. Owners must know how provider changes are communicated and tested before they affect customers.
How do you meet SS1/23 and show it?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Identification and inventory | Agents and components inventoried with the model risk function | Model inventory entries |
| Risk tiering | Tier set by most consequential capability; re-tiered on change | Tiering records |
| Accountability | Named owner per agent; accountable senior manager briefed | Owner register; SMF briefings |
| Fit for purpose | Certification on the bank's own cases before depth is granted | Certification results by gate |
| Independent validation | Validators challenge certification evidence | Validation reports; owner responses |
| Restrictions on use | Depth limits and holds documented as mitigants | Mitigant register; rationale |
| Monitoring | Overrides, drift and recertification tracked | Monitoring packs |
| Owner competence | Owners trained on agents before appointment | Training records |
What will the PRA or an auditor ask?
- Which agents are in your inventory, and how are they tiered?
- Who owns this agent, and what did they need to learn to own it?
- What evidence supports its current depth?
- What did validators challenge, and what changed?
- How do you use depth limits to mitigate model weakness?
- What happens when the provider changes its model?
Supervisors increasingly test the people as well as the models; the argument is made in regulators will ask who was trained, not which model you used.
What does SS1/23 not cover?
It does not regulate conduct towards customers; the FCA does, including through the Consumer Duty. It does not replace data protection duties under UK GDPR, which the ICO supervises. It does not prescribe training content or certification. And it does not by itself require human review of every agent decision; it requires risk-based controls owners can defend. The fuller treatment is in PRA SS1/23 model risk management for AI agents, and Canadian banks can compare how OSFI E-23 applies to AI agents. For owner training that ends in a checkable credential, Pryme Intelligence Academy runs a Builder track with a capstone agent certified in Attest. The guide to AI literacy and certification covers the wider model.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Does SS1/23 apply to banks without internal model approval?
The PRA expects those banks to consider the principles as appropriate to their size and models. Many apply them in full.
Is keeping an agent at a low depth a valid mitigant?
Yes. Restricting use is a recognised mitigant. Document why the restriction is in place and what evidence would lift it.
Who is the accountable senior manager for agents?
Usually the senior manager accountable for model risk management, working with the business owner of each agent.