Under SM&CR, the senior manager who owns an AI agent is the one responsible for the business area where the agent's actions take effect, not the one who runs the technology. Allocate each capability to the senior manager for the outcome it changes, record that in the agent register, and make sure it matches their statement of responsibilities.
What does the regime require when allocating responsibility?
The Senior Managers and Certification Regime gives each senior manager a written statement of their responsibilities, and larger firms keep a map that shows how responsibility for every activity is split across senior managers. The aim, in substance, is that nothing the firm does falls between two people or outside everyone.
Neither the FCA nor the PRA has issued a rule naming who must own AI. That is consistent with the UK's principles-based approach. The firm decides, and the regulator judges whether the allocation is clear and real. For the wider regime, see our overview of the Senior Managers and Certification Regime and AI agents.
Who does the allocation question apply to?
Any firm in the regime where agents perform or support regulated activity. It matters most where several senior managers could plausibly claim, or disclaim, an agent: the chief operating officer, the chief information officer, the head of a business line and the head of compliance often all touch the same agent.
The common failure is giving every agent to the technology senior manager because it is "an IT system". That puts responsibility for credit decisions, complaint outcomes or payments with someone who does not own those outcomes and cannot judge whether they are right.
How does the answer change when the agent acts?
An agent that only reads data affects little on its own, so the owner of the data it reads is usually enough. Once an agent drafts customer letters, settles claims or moves money, it produces outcomes, and the owner must be the person accountable for those outcomes.
Apply three rules in order.
- Allocate by effect, not by build. The senior manager responsible for the area where the action lands owns the capability. A collections agent belongs to the head of collections.
- Split shared agents by capability. One agent can answer balance queries for retail and draft dispute letters for cards. Each capability goes to the senior manager for its area, and the register shows both names.
- Give the platform its own owner. Whoever is responsible for operations or technology owns the guardrails, identities and credentials every agent relies on, including how secrets are held, which our guide on storing an agent's credentials in a secrets manager covers. They do not own business outcomes.
An orchestrator that coordinates other agents across a process, for example account opening from application to first payment, belongs to the senior manager who owns that end-to-end process. If no one does, that is a gap in the map that existed before the agent arrived.
How do you record the allocation?
Record ownership in one place and make the other records point to it. The control table below sets out what to keep.
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Every agent has a named senior manager | Agent register field for owning senior manager, mandatory before any depth above 1 | Register entry with name, function and date allocated |
| Shared agents have no gaps | Ownership recorded per capability, not only per agent | Capability-level rows in the register |
| Allocation matches formal documents | Each statement of responsibilities references the agents in that area | Cross-check between register and statements at each update |
| Day-to-day running is clear | A named operational owner below the senior manager | Register field for operational owner and deputy |
| Platform controls have an owner | Technology or operations senior manager owns guardrails and credentials | Separate register entry for platform controls |
| Changes are tracked | Ownership changes approved by both outgoing and incoming senior manager | Change log and handover note |
The register entry for one agent should fit on a screen: agent name, each capability with its depth, the owning senior manager for each, the operational owner, the certificate status and the date ownership was last confirmed.
What will a supervisor ask about ownership?
- Show us the agent register, and show us where these agents appear in the statements of responsibilities.
- This agent drafts both credit decisions and marketing messages. Who owns each?
- Who decided to raise this agent's authority, and was that the owning senior manager?
- When the owning senior manager changed role, what was handed over?
- Who owns the credentials and permissions the agent uses?
Ownership questions often come first in a review, because everything else depends on them. If the answer to the first one takes a day to assemble, the allocation is not real yet. Once ownership is clear, the next question is whether the owner did enough, which is the subject of SM&CR reasonable steps when an agent acts.
What does allocation not settle?
Allocation tells you who answers. It does not tell you what the agent may do, how it is tested or whether its outputs are right. Those are design and assurance questions, set out in our guide to agent governance as a bound, not a model.
It also does not settle accountability outside the regime. Company law, contracts and data protection law each have their own answer to who owns an AI agent's decisions in a company. For disputed or unusual cases under the regime, see who is the accountable senior manager for an AI agent.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
Pryme grants authority per capability, so each capability of an agent can carry its own owner, its own depth and its own certificate. A capability cannot rise above depth 1 without evidence from Attest, and every action is filed with the bound that decided it, giving the owning senior manager a record of what happened in their area.
Questions people ask
Can a committee own an AI agent under SM&CR?
A committee can oversee agents, but the regime needs a named individual. Give the committee a role in approving changes and keep a single senior manager as the owner of each capability.
Should the chief risk officer own all AI agents?
No. The chief risk officer oversees risk across the firm and should challenge agent owners, not own business outcomes. Owning the agents would compromise that independence.
What if an agent is still in testing?
Record an owner from the start. A test agent at depth 1 still reads customer data, and the senior manager who will own it in production should approve what it reads.