No single UK law requires AI agent training, yet UK organisations still need it. The UK regulates AI through existing regulators, and they expect accountable, competent people behind every decision. In practice that means literacy for everyone near an agent and certified competence for anyone who releases its held actions, recorded so a supervisor can check it.
Why does the UK expect training without an AI law?
The UK takes a principles-based, regulator-led approach to AI rather than passing a single AI statute. The rules that matter already exist. The Senior Managers and Certification Regime makes named individuals accountable for areas of a financial firm, and that accountability does not pause when an agent does part of the work. The FCA's Consumer Duty expects good outcomes for retail customers, whoever or whatever drafted the letter they received.
So the question a UK supervisor asks is not "did you comply with the AI law?" but "who decided, were they competent, and was the customer treated well?" Training is how you answer the middle part.
Which UK regulators shape the training?
- The FCA supervises conduct, including the Consumer Duty and SM&CR.
- The PRA, part of the Bank of England, supervises banks and insurers prudentially. Its SS1/23 model risk management principles for banks expect models, and the people who own and use them, to be governed.
- The ICO enforces UK GDPR and the Data Protection Act 2018. Article 22 restricts decisions based solely on automated processing with legal or similarly significant effects, which puts weight on the reviewer. The UK GDPR guide for staff who review AI agent decisions covers this in detail.
- The PSR regulates payment systems.
UK firms serving EU customers may also fall under the EU AI Act, including Article 4 on AI literacy.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What should UK staff learn?
Everyone near an agent needs four things: depth (1 read, 2 draft, 3 routine within bounds, 4 money or hard-to-undo actions, 5 coordinating agents); the four verdicts; provenance, where an external claim cannot authorise a payment; and expiry, since agent certificates lapse after 90 days and a run that clears no depth drops the agent to depth 1 the same day.
Approvers need more. They must read the minimum chain, see which bound held an action, release or reject with a recorded reason, and recognise when a customer may be vulnerable and the draft needs a different response altogether.
What may the agent do, and what stays with a person?
| Work | Agent | Person |
|---|---|---|
| Reading a claim or account file | Depth 1 | Interpreting it |
| Drafting a collections letter | Depth 2 | Sending it, and spotting vulnerability |
| Setting up a payment plan within limits | Depth 3 | Anything outside the limits |
| Paying a claim | Prepares and holds at depth 4, if certified | Releasing it |
| Declining a claim | Drafts the reason | Making and owning the decision |
The operations manager brief for insurance in the UK and the collections brief for telecoms in the UK apply this to two very different teams.
How does SM&CR change who gets certified first?
Start with the people whose names sit in the accountability map. A senior manager responsible for claims or collections must be able to explain how agents in their area are governed, what depth they hold and who approves their actions. Then certify the approvers who report to them, because their decisions are the evidence that the senior manager took reasonable steps.
Make approval rights depend on a current credential. When a credential expires, the right goes with it, and the record shows the change.
How do you evidence it?
Join three records: the training record per person, with results and expiry; the approval rights policy; and the append-only record of agent verdicts, naming who released each held action. A credential that can be checked at source, such as a Pryme Intelligence Academy certificate issued through VerifyDoc.ai, lets an auditor confirm standing without asking for copies. The full model is in AI literacy and certification for people who work with agents. Compare the Australia guide, another principles-led market.
Questions people ask
Does the FCA require AI qualifications?
The FCA does not set a specific AI credential. It expects competent, accountable people and good customer outcomes, which trained and certified approvers help demonstrate.
Does the EU AI Act's literacy duty apply in the UK?
Not to a purely domestic UK firm. A UK firm that places AI systems on the EU market or uses them to serve EU customers should take advice on whether it applies.
Who should own AI agent training in a UK bank?
Usually the senior manager accountable for the area where agents act, supported by risk and learning teams. Ownership should be clear on the responsibilities map.