Better detection does not reduce the work of surveillance; it moves it. An agent that reads more communications, links more accounts and spots subtler patterns produces more matters that someone must judge. Unless reviewer capacity, triage rules and decision ownership grow alongside it, a stronger detector simply builds a longer queue of undecided cases.
Why does better detection create more decisions?
Surveillance has always been limited by what it could see. Communications surveillance has traditionally relied on keyword lists and samples. Market abuse surveillance has relied on rules tuned to known patterns. Both missed a lot, and both produced a manageable number of alerts partly because they missed a lot.
Agents change what can be seen. They can read meaning rather than keywords, connect a chat message to an order placed minutes later, and notice that two customers who never transact share a device, a phone number and a pattern of logins. Whether an AI agent can find hidden links between customers is no longer the question; it can. The question is what happens next.
Every new connection the agent finds is a potential matter. Each one needs a person to decide: is this misconduct, a coincidence or something that needs more investigation? Better detection means more of those decisions, not fewer.
What happens when review capacity does not keep up?
Three failure modes appear, usually in this order.
Backlog. Alerts accumulate faster than reviewers can clear them. Old alerts age, and some become irrelevant before anyone looks. A matter that was a warning sign in its first week is a missed opportunity by its tenth.
Rubber-stamping. Under pressure, reviewers start closing alerts quickly. The agent's summary becomes the decision in practice, without anyone having decided that it should.
Silent threshold changes. Someone raises a threshold or narrows a rule to bring alert volumes down to what the team can handle. Detection falls back to where it was, but the firm still believes it has the stronger system.
All three leave the firm worse placed than before, because it now has evidence that it could see more and chose not to act on it.
How should the agent help with decisions without making them?
By making each decision faster and better informed, not by taking it. The useful work sits around the judgement.
| Stage | The agent | Depth | The person |
|---|---|---|---|
| Detect | Flags the matter with the evidence that triggered it | 1 | |
| Triage | Groups related alerts, ranks by severity using approved criteria | 1 | Sets and approves the criteria |
| Assemble context | Pulls related communications, trades, accounts and history | 1 | |
| Draft the review | Summarises the matter, lists what supports and what weakens concern | 2 | Reads, challenges, decides |
| Close or escalate | Not permitted | Reviewer closes, escalates or opens an investigation | |
| Act on findings | Not permitted | Investigators, compliance and management |
Triage is the most powerful lever. Grouping twelve alerts about the same trader and the same event into one matter cuts the decisions needed without reducing what is seen. Ranking by severity lets reviewers spend their time where the risk is highest. Both should follow criteria a person has approved, so the agent is applying a rule, not deciding priority on its own.
The specific case of trading surveillance is discussed in whether an AI agent can do market abuse surveillance.
Who decides the thresholds?
A named person in the surveillance or compliance function, with the decision recorded. Thresholds determine what the firm chooses not to look at, which makes them some of the most consequential settings in the system.
A threshold change should be treated as a governance event. Record who changed it, why, what volume and type of alerts it removed, and how that was judged acceptable. Then test it periodically: sample from below the threshold and check whether anything significant is being missed. If capacity is the reason for a change, say so in the record. It is a legitimate reason, but it should be visible.
What about everything the agent did not flag?
That matters as much as the flags. When a supervisor asks whether the firm reviewed a particular trader's communications in a given period, the answer depends on whether the agent recorded what it read and found unremarkable, not only what it flagged. The argument is made in full in compliance agents must record what they did not find.
How should a firm plan for the extra decisions?
Before switching on a more capable surveillance agent, estimate how many more matters it will produce, using a trial on past data. Then decide, explicitly, how those matters will be handled: more reviewers, better triage, tighter grouping, or a deliberate threshold with its trade-off recorded. Any of these can be right. Discovering the volume after go-live and improvising is not.
It also helps to measure reviewer workload alongside detection. A dashboard that shows only how many matters were found invites the mistaken conclusion that more is better. One that also shows how long matters waited and how much time each review received tells the true story.
Where Pryme fits
In Pryme, surveillance agents can be certified at depth 1 and 2 on the firm's own past matters, with triage criteria held as the customer's own limits. Closing or escalating a matter is held for a named reviewer, and every verdict, including matters reviewed and set aside, is filed in the append-only record. This follows the principle that AI compliance agents are second line, never the last word.
Questions people ask
Should the agent close low-risk alerts on its own?
Only under tightly defined, approved rules for clearly benign patterns, with regular sampling. Judgement-based closure should stay with reviewers.
Does grouping alerts risk hiding individual issues?
It can, if groups are too broad. Keep the underlying alerts visible within each matter, so a reviewer can see every item that contributed.
How do you justify more reviewers to the business?
Show the volume the agent produces on past data, the time each review takes, and the risk of the backlog. Better detection without capacity is evidence of known but unreviewed risk.