All five SS1/23 principles reach AI agents: identify and tier them, govern them under a named senior manager, develop and use them soundly, validate them independently, and apply mitigants where risk is high. For agents that act, expect supervisors to focus on mitigants, because limiting what an agent may do is the most direct way to contain model risk.
What does SS1/23 require, in plain words?
SS1/23 sets out the PRA's expectations for model risk management at banks as five principles:
- Model identification and model risk classification: a clear model definition, a full inventory, and a risk tier for each model.
- Governance: board oversight, a model risk management policy, a model risk appetite, and a senior manager accountable for the framework under the Senior Managers and Certification Regime.
- Model development, implementation and use: a clear purpose, suitable data, a sound and documented method, testing before use, and use within the model's intended scope.
- Independent model validation: review by people independent of development, proportionate to tier, with findings acted on, and continuing review of performance in use.
- Model risk mitigants: processes to address model limitations and uncertainty, such as restrictions on use, adjustments to outputs and escalation, especially where validation finds weaknesses.
The PRA expects AI and machine learning methods to be managed within the same framework, with attention to their particular features such as complexity, opacity and frequent change. For the definitional question, see PRA SS1/23 and generative AI agents: is an agent a model?
Who does it apply to?
Primarily UK banks and building societies with permission to use internal models for regulatory capital. Other PRA-regulated firms are encouraged to consider the principles. For a short answer on scope, see does PRA SS1/23 cover AI agents.
What does each principle mean for an agent that acts?
Identification and tiering. Agents belong in the inventory with their capabilities listed. Tiering should reflect not only how influential the output is but what the agent can do with it: an agent that executes payments sits higher than one that drafts.
Governance. The model risk appetite should say how much authority agents may hold in each area, and who may approve more. The accountable senior manager should receive reporting that shows agents by authority level, validation status and incidents.
Development and use. Document the agent's purpose, brief, sources, tools and limits. "Use within intended scope" is where agents differ most from traditional models: an agent's scope must be enforced technically, because an agent can attempt actions outside it.
Independent validation. Validate each capability on the bank's own cases, with the version of each component recorded. Our piece on SS1/23 model validation for agents covers the file in detail.
Mitigants. For traditional models, mitigants often mean adjusting outputs or adding conservatism. For agents, the strongest mitigant is reducing authority: moving a capability from executing to drafting, so a person decides; holding actions above a limit for approval; or removing a tool. These mitigants are precise, can be applied the same day, and leave a record.
How do you show supervisors the framework works?
Take an illustrative case. A UK retail bank runs an agent that reviews direct debit indemnity claims. Validation finds it handles simple claims well but misjudges claims involving joint accounts. Under its mitigants process, the bank keeps the agent executing for single-account claims within a limit, moves joint-account claims to drafting for an operations officer, and records both decisions with the validation finding behind them. The senior manager's monthly report shows the restriction, and it lifts only after re-validation on joint-account cases.
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Identification and tiering | Agents inventoried with capabilities; tier reflects authority to act | Inventory entries and tier rationale |
| Governance and appetite | Appetite for agent authority by area; senior manager accountable | Policy; appetite statement; responsibilities map |
| Reporting | Regular reporting on agents by authority, validation status and incidents | Management and board reports |
| Development and documentation | Purpose, brief, sources, tools and limits documented and versioned | Design records |
| Use within scope | Limits enforced before every action | Verdict log of allowed, held and refused actions |
| Independent validation | Per-capability validation on the bank's cases by an independent team | Validation reports |
| Performance in use | Override, escalation and complaint signals tracked against validation | Monitoring reports |
| Mitigants | Authority reduced or actions held where validation finds weaknesses | Mitigant decisions linked to findings |
Our glossary entry on model risk management gives the general background.
What will a PRA supervisor ask?
- Show us your agents by tier and by what they are allowed to do.
- What does your model risk appetite say about agents acting without a person?
- How do you enforce an agent's intended scope?
- What mitigants have you applied after validation findings on agents?
- What does the accountable senior manager see each month?
- How do you respond when a model provider changes the underlying model?
What does SS1/23 not cover?
It does not cover conduct towards customers, which the FCA supervises, or data protection, which the ICO enforces. It does not set operational resilience requirements, though agents supporting important business services will need to meet those too. Other supervisors have parallel expectations; Canada's are explained in how OSFI E-23 applies to AI agents. For the full map, see our guide to AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
Pryme expresses SS1/23's mitigants as depth. Each capability's depth is earned on the bank's own cases through Attest, capped by its plan, and can be lowered at once when a finding demands it. The minimum chain enforces intended scope on every action, and the verdict record shows the accountable senior manager exactly what each agent did.
Questions people ask
Is reducing an agent's authority a recognised model risk mitigant?
SS1/23 expects firms to restrict or adjust model use where limitations are found. Reducing an agent from executing to drafting is a restriction on use, and it has the advantage of being precise and immediately effective.
Does SS1/23 require a model risk appetite for AI specifically?
It requires a model risk appetite. Firms using agents should make sure it addresses them, because an appetite written for scoring models says little about software that acts.
How often should agents be reported to the board?
As often as their materiality warrants. Banks with agents acting on customer accounts typically include them in regular model risk reporting, with incidents escalated as they occur.