Regulators will ask who was trained, not which model you used

Supervisors examining an agent deployment will spend less time on the model's name than most teams expect. Their questions follow accountability: who approved this action, with what authority, and how do you know they were competent? The model is one input among many. The people around it, and the evidence of their training, are what a regulator holds to account.

Why is the model the less interesting question?

Models change. A business may switch model providers, use several at once, or receive an updated version without changing anything on its side. A supervisor who anchored their review on the model would have to start again every time. More importantly, regulators supervise firms and individuals, not software. They cannot sanction a model.

That does not mean the model is ignored. In banking, model risk management is a supervised discipline: the PRA's SS1/23 sets out model risk management principles for banks in the UK, OSFI Guideline E-23 covers model risk management for federally regulated institutions in Canada, and in the US the interagency guidance SR 11-7 has long shaped how banks validate models. But read any of those frameworks and the striking thing is how much of it is about people: model owners, validators, governance committees, clear responsibilities. The model is tested; the people are accountable.

For governed agents, the parallel is close. Each agent is certified on the firm's own cases, every action meets a chain of bounds, and every verdict is filed with the name of anyone who approved it. A supervisor reading that record will go straight to the names.

What will a supervisor actually ask?

Expect questions like these:

1. Who owns this agent? A named person, with a defined role, not "the AI team".
2. Who approved this held action, and were they authorised to? The verdict record answers the first part; your approval rights answer the second.
3. How did you establish that the approver was competent? Attendance at a course is a weak answer. A current certificate, earned on observed work and checkable at source, is a strong one.
4. Was the certificate current on the day? If certificates expire, can you show status at the time of the decision?
5. Who sets the limits the agent works within, and how were they trained to set them?
6. What happens when someone's competence lapses?

The piece on why auditors will ask for the verdict record explains how the record supports the first two. Training evidence supports the rest.

How do model risk frameworks extend to the people?

Model risk frameworks expect firms to know who owns each model, who validated it, and who uses its output. When the "model" is an agent that acts, the users of its output are the reviewers who approve held actions. Their competence becomes part of model risk.

That is why the articles on PRA SS1/23 and training model owners and OSFI Guideline E-23 and training model owners focus on people as much as process. An owner who cannot explain what the agent may do, at what depth, and how its authority is earned and lost is not providing the oversight the framework expects.

Does this apply outside banking?

Yes, in different forms. Payments firms face questions about who approved releases and refunds an agent prepared, and how the firm knows those staff were trained; how payment companies can prove staff are trained covers the practical side. Insurers face similar questions about underwriting and claims decisions.

And it is not only regulators. Corporate clients increasingly ask suppliers the same question before they sign: if your agents act on our behalf, who oversees them and what evidence of their training can you show? The article on what evidence of training clients ask suppliers for sets out what a supplier should have ready.

What is the trade-off?

Shifting attention from models to people risks neglecting the model. Validation, testing and monitoring of what the agent actually does still matter, and a firm with perfectly trained reviewers can still deploy an agent that should never have been certified.

There is also the cost of producing training evidence good enough to satisfy a supervisor. Attendance lists are easy; current, checkable certificates tied to approval rights take effort to build and maintain.

The answer is not to choose. Certify the agent on evidence from your own cases, and certify the people who approve its work on evidence from theirs. The two kinds of evidence support each other: the agent's certification shows what it may do alone; the people's certification shows that what it hands back is judged competently.

What should you do differently?

Prepare for the question you will actually be asked. For every agent, name the owner and the approvers. For every approver, keep evidence of competence that shows status on any given day. Link approval rights to that evidence, so the verdict record and the training record tell one story. Brief the people who will meet the supervisor on how all of this fits together. And keep model validation in place alongside it. The guide to AI literacy and certification for people who work with agents explains the levels. This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

Where the Academy fits

Pryme Intelligence Academy produces the kind of evidence a supervisor can test. Certificates are issued through VerifyDoc.ai, checkable at source, and show lapsed or revoked status on the same page. For teams, an admin view shows progress, results, certificates and expiry dates, so a firm can show who held current standing when.