Regimes that make named individuals accountable for areas of a regulated business do not create an exception for software. If an AI agent makes decisions in a senior manager's area, that manager answers for them as for any team. The practical question is what that person must know, see and control to be able to show they took reasonable steps.
What does individual accountability mean in the UK?
The Senior Managers and Certification Regime makes named individuals accountable for specific areas of a regulated firm. Each senior manager has documented responsibilities, and regulators can hold them to account where something goes wrong in their area and they did not take reasonable steps to prevent it. Our explainer on the Senior Managers and Certification Regime and AI agents covers the regime in outline.
Nothing in that structure depends on whether work is done by people, systems or agents. An agent handling complaints sits within the responsibilities of whoever is accountable for complaints handling. An agent assessing affordability sits within whoever is accountable for lending. Our page on who the accountable senior manager for an AI agent is under SM&CR works through how to assign it.
Is it the same outside the UK?
The mechanisms differ; the principle is common. In the United States, the interagency model risk guidance SR 11-7 expects boards and senior management to oversee model risk, including setting policy, assigning responsibility and making sure resources are adequate. Our page on SR 11-7 board and senior management oversight of agents covers that framing. Many other supervisors expect clear senior accountability for operational and conduct risk, whether or not they have a formal named-person regime.
In every case, an agent is a way of doing work, not a party that can hold responsibility. The accountability stays where it was.
Why is this harder with agents than with teams?
Because the usual sources of assurance are weaker. A senior manager overseeing a team relies on team leaders, management information, quality checks and their own sense of how the team works. They can ask people what happened and why.
An agent offers none of that by default. It does not report to a team leader. Its management information may be built by the technology team that runs it, focused on volume and uptime. It cannot be asked why in any reliable way; its explanation is generated text. If the senior manager has not arranged specific oversight, they may know far less about the agent's decisions than about their team's, while being just as accountable.
What do reasonable steps look like for an agent?
A senior manager should be able to show that they understood what the agent does, that its authority was set deliberately, that they received information to oversee it and that they acted on what they saw.
| Reasonable step | What it means for an agent | Evidence |
|---|---|---|
| Know what is in your area | An inventory of agents and their capabilities in your responsibilities | Agent register mapped to your responsibilities |
| Delegate deliberately | Each capability's depth and limits set by a named owner, on evidence | Delegation records; certification results |
| Receive meaningful information | Verdict patterns, held and refused items, incidents, widening decisions | Regular management information on each material agent |
| Challenge and act | Questions raised, depth lowered when signals warrant | Minutes; narrowing decisions with reasons |
| Make sure oversight works | Approvers with time and authority; independent review | Approver capacity plans; audit and second-line findings |
None of these needs the senior manager to understand how the model works. All need them to understand what the agent may do and how they would know if it went wrong.
What about agents in the second line?
Accountability does not get simpler when the agent supports compliance or risk functions. If a monitoring agent misses something it should have flagged, the senior manager responsible for that monitoring answers for the gap. Our piece on who is accountable when a compliance agent misses something explores that case. The same reasonable steps apply: know what the agent does, set its scope deliberately, see how it performs and act on what you see.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What should senior managers ask for?
Three things, as a minimum. A list of every agent operating in their area, with each capability and its depth. A regular report on each material agent showing verdicts by type, the bound behind held and refused actions, attempts to act beyond bounds, incidents and changes in depth. And the power, written down, to lower any agent's authority in their area immediately, without needing a committee.
With those, a senior manager can show oversight. Without them, they are accountable for decisions they cannot see.
What is the trade-off?
Real oversight takes senior time and requires management information that many agent deployments do not produce by default. Technology teams may need to build reporting they had not planned, and senior managers may need briefing on concepts such as depth and bounds.
The alternative is accountability without control, which is uncomfortable for the individual and a weakness supervisors are likely to probe. If you are a senior manager with agents in your area, ask for the inventory, the report and the power to narrow. If any of the three is missing, that is the first gap to close. The wider mapping of rules to controls is in our guide to AI agent regulation, mapped to controls.
Where Pryme fits
In Pryme, every agent has a named owner and each capability's depth is recorded with the evidence behind it. The verdict record gives senior managers counts of allowed, held, refused and withheld actions with the deciding bound, and capability owners can lower depth at once. Accountability stays with your people; the record gives them the means to exercise it.
Questions people ask
Can accountability for an agent be given to the vendor that supplied it?
No. A vendor can owe contractual duties, but regulatory accountability for an area of the firm stays with the firm and its named individuals. Vendor management is one of the reasonable steps, not a transfer of responsibility.
Should there be a single senior manager for all AI agents?
Some firms assign overall responsibility for AI governance to one person, which helps with consistency. Accountability for the outcomes of each agent still sits with the senior manager responsible for the business area it operates in.
How often should senior managers review their agents?
Regularly, at a frequency matching the risk. Agents that move money or affect customer outcomes warrant at least monthly information and immediate notice of incidents or depth changes.