Under the Senior Managers and Certification Regime, a named senior manager answers for each area of a UK financial firm, and staff in certification functions must be assessed as fit and proper, including competent. When AI agents act in those areas, firms must prove that senior managers took reasonable steps and that certified staff can oversee the agents.
What does SM&CR ask of people who oversee agents?
SM&CR sets out individual accountability in firms regulated by the FCA and, for dual-regulated firms, the PRA. In substance it has three parts.
- Senior managers. People in senior management functions need regulatory approval. Each has a statement of responsibilities setting out what they answer for. Under the duty of responsibility, a senior manager can be held accountable for a breach in their area if they did not take reasonable steps to prevent it.
- The certification regime. Staff who are not senior managers but whose roles could cause significant harm to the firm or its customers perform certification functions. The firm must assess them as fit and proper, which includes competence and capability, before they start and periodically after that, and certify them.
- Conduct rules. Basic standards of behaviour apply to almost all staff, including acting with due skill, care and diligence.
None of this mentions AI. All of it applies when agents act inside a senior manager's area or a certified person's role. The question of which senior manager owns an AI agent is the starting point.
Who does it apply to?
Banks, building societies, insurers and the wide range of solo-regulated FCA firms, with requirements scaled by firm type. Inside them, the people who matter for agents are the senior manager accountable for each area where agents operate, staff in certification functions who release agent actions or oversee agents, and everyone subject to the conduct rules who works with agents day to day. The detail of who the accountable senior manager is for an AI agent depends on the firm's responsibilities map.
What does competence mean when the system is an agent?
For senior managers: reasonable steps. A senior manager cannot plead ignorance of an agent working in their area. Reasonable steps, in an agent context, are likely to include knowing which agents operate, what each may do at which depth, and what is held for people; receiving information on verdicts, overrides and incidents; ensuring the people overseeing agents are competent; and acting when the evidence shows a problem. Depth is earned on the firm's own cases, the role sets a ceiling, the lower wins, and agent certificates lapse after 90 days. A senior manager should know all of that about the agents in their area.
For certified staff: fitness includes competence. Where a role performing a certification function involves releasing agent actions at higher depths, such as approving held payments at depth 4 or confirming credit decisions, the fit and proper assessment should cover competence to oversee the agent. That means understanding its capabilities, its sources and their provenance, its failure modes, and the four verdicts: allowed, held, refused and withheld.
For everyone: due skill, care and diligence. Staff who release a held action without reading it may fall short of the conduct rules. Training should make clear that releasing an agent's work is the person's own act.
Proving it. SM&CR turns on evidence. Completion records show attendance; evidence of competence shows ability. For agent oversight, the best evidence is performance on real or seeded cases, with results recorded against the person.
How do firms meet SM&CR and show it?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Clear senior manager accountability | Each agent mapped to a senior manager's responsibilities | Responsibilities map; statements of responsibilities |
| Reasonable steps | Senior manager receives agent MI and briefing | MI packs; briefing records; actions taken |
| Fit and proper, including competence | Agent oversight competence assessed for relevant certified roles | Assessment results in certification files |
| Periodic recertification | Competence re-checked when agents change and at certification | Recertification records |
| Conduct rules | Training that releasing agent work is the person's act | Training records; conduct cases |
| Release rights follow competence | Only assessed, current staff release held actions | Access grants linked to assessments |
| Traceability | Every verdict filed with the releasing person | Append-only decision record |
What will the FCA, PRA or an auditor ask?
- Which senior manager answers for this agent?
- What does that senior manager know about it, and what MI do they receive?
- Which certified staff release its actions, and how was their competence assessed?
- Show us the certification file for this person. Does it mention agents?
- What happened when an agent's capability changed?
- How do you know releases are not rubber-stamped?
What does SM&CR not cover?
It does not regulate the agent's design or model risk; PRA SS1/23 does for banks. It does not set customer outcome standards; the FCA Consumer Duty does. It does not prescribe a training curriculum or require any particular certificate. And outside the UK, comparable duties differ; in the EU, the AI Act's deployer duties, including those discussed in Article 26 and staff competence in consumer lending, set a different but overlapping bar. The guide to AI literacy and certification covers the wider model.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where the Academy fits
Pryme Intelligence Academy certificates give certification files checkable evidence. Certified Pryme Operator rests on a written exam and a practicum signed off by a Pryme assessor; certificates are issued through VerifyDoc.ai and show as lapsed or revoked on the same page when that happens. A firm can adopt a practice of granting release rights at each depth only to staff with a current certificate.
Questions people ask
Is overseeing an AI agent a certification function?
Not in itself. But roles that already perform certification functions may now include agent oversight, and their fitness assessment should cover it.
What counts as reasonable steps for a senior manager?
Knowing what agents do in their area, receiving information about them, ensuring overseers are competent, and acting on problems. Record each of these.
Can a senior manager delegate agent oversight?
They can delegate tasks, not accountability. They must still oversee how the delegation works.