PRA SS1/23 expects a bank's board to own model risk, a named senior manager to be accountable for the framework, and each model to have an owner, with use approved by an appropriate authority. For AI agents, that means recording which components are models, naming one owner per agent, and approving each use before it goes live.
What does SS1/23 require on governance?
SS1/23 sets out the PRA's model risk management principles for banks. It defines a model broadly, as a quantitative method that applies statistical, economic, financial or mathematical theories to process input data into output, and it expects firms to cover the outputs of AI and machine learning techniques within that scope. Its principles address model identification and classification, governance, development and use, independent validation, and risk mitigants. Our piece on SS1/23 model risk management for agents covers the full set.
On governance, in substance:
- The board sets model risk appetite and oversees the framework.
- A senior manager, holding a function under the Senior Managers and Certification Regime, is accountable for the model risk management framework.
- Policies define roles and responsibilities across the model lifecycle.
- Each model has a model owner, accountable for its use and performance, alongside model developers and model users.
- Approval of models, and of material changes, comes from an appropriate authority, with authority levels set by model risk tier.
- Management information on model risk reaches the board and senior management.
Who does it apply to?
SS1/23 is addressed to UK banks and building societies, and certain investment firms, that have permission to use internal models for regulatory capital. The PRA has indicated that other firms may find its principles useful in managing their own model risk. In practice, many UK banks apply it across their model estate. Our answer to whether SS1/23 covers AI agents addresses scope directly.
Is an agent a model, and who owns it?
An agent is not a single model. It combines a language model from a model provider, a brief, retrieved sources, tools and bounds. Parts of it clearly meet the SS1/23 definition: a component that scores, ranks, classifies or estimates is processing inputs into quantitative or decision outputs. Our piece on whether an agent is a model under SS1/23 works through the reasoning.
For governance purposes, we recommend a simple position: treat the agent as the governed unit, record which of its components are models in the inventory, and give the agent one owner.
That owner should be in the business line that uses the agent, because they answer for its outputs and actions. Supporting roles follow the SS1/23 pattern:
- Developers build and change the agent's brief, sources and tool connections.
- Users rely on its outputs or work alongside it.
- Validators test it independently before approval and periodically after.
- Approvers at the right authority level approve its use and material changes.
What changes because the agent acts?
SS1/23 was written mainly for models whose outputs feed human decisions or calculations. Agents take actions. Three governance consequences follow.
Approval must cover authority, not just the model. Approving a credit agent's scoring component is not the same as approving the agent to send decline messages or adjust limits. Approval should state what the agent may do, at what depth, within which limits.
Tiering should reflect action. SS1/23 asks firms to tier models by risk. An agent's tier should rise with the impact of its actions, not only the materiality of its outputs.
Material changes are frequent. A change to the brief, a new data source, a new tool or a model provider update can each change behaviour. Define which are material and route them to approval.
How do you meet the governance principles for agents?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Board sets appetite | Board-approved appetite for agents, by action type | Board minutes and appetite statement |
| Senior accountability | Named senior manager accountable for framework covering agents | Statement of responsibilities |
| Model identification | Inventory lists each agent and its model components | Model inventory entries |
| Named owner | One business owner per agent | Ownership register |
| Approval by authority level | Use and material changes approved at a level matching tier | Approval records |
| Tiering reflects action | Agent tier set by output materiality and action impact | Tiering assessments |
| Management information | Agent performance, overrides and incidents reported to senior management | MI packs |
Many banks hold this data in a governance, risk and compliance platform. Our playbook on how to connect an agent to your GRC platform covers linking agent records to the inventory.
What will the PRA or internal audit ask?
- Which agents are in your model inventory, and which components are models?
- Who owns each agent, and who approved its use?
- What may each agent do, and was that included in the approval?
- How are agents tiered, and does action impact affect the tier?
- What counts as a material change to an agent, and who approves it?
- What does the board see about agent risk?
What does SS1/23 not cover?
It does not govern conduct outcomes; the FCA Consumer Duty does that for retail customers. It does not cover data protection, which falls under UK GDPR and the ICO. It does not address operational resilience in full, which has its own PRA and FCA requirements. For the general meaning of AI governance, see what AI governance is, and for why governance needs enforced limits, our guide agent governance is a bound, not a model.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Should the model provider's language model be in the inventory?
Yes, as a component of each agent that uses it. Record its version and make provider changes trigger review, since you cannot validate it directly in the usual way.
Can the agent's owner also approve it?
No. SS1/23 expects approval by an appropriate authority, separate from those who develop and own the model. The owner proposes; an approver decides.
Does SS1/23 apply to an agent that only drafts emails?
If no component meets the model definition and the agent informs no decisions, it may sit outside scope. Most agents in banks do inform decisions, so check carefully.