US organisations need AI agent training built around the regulator they answer to, because there is no single federal AI law to build it around. Everyone near an agent needs literacy in depth, verdicts and provenance. Approvers need certified competence. Then the sector rules, from SR 11-7 in banking to HIPAA in healthcare, decide what extra each role must know.
Which US rules shape AI agent training?
The US picture is a patchwork, so map your own obligations first:
- Banking. The OCC, the Federal Reserve and the FDIC supervise banks, and interagency guidance SR 11-7 expects models to be validated, owned and used by competent people. The SR 11-7 guide for training model owners covers this in depth.
- Credit. ECOA and Regulation B require specific reasons when credit is denied, including when a model is used. The CFPB enforces consumer financial protection.
- Securities. The SEC and FINRA supervise broker-dealers and advisers.
- Insurance. State insurance regulators supervise insurers, with the NAIC coordinating; state regulators such as NYDFS add their own expectations.
- Health. HIPAA governs health information and expects workforce members who handle it to be trained.
- Privacy. GLBA covers financial privacy, and state laws such as California's CCPA as amended by the CPRA add more. Colorado has passed an AI act aimed at high-risk systems that make consequential decisions.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What should every US employee near an agent know?
Four things, tested rather than assumed. Depth, per capability: 1 read, 2 draft, 3 routine work within bounds, 4 money or hard-to-undo actions, 5 coordinating other agents. The four verdicts: allowed, held, refused and withheld. Provenance: sealed, signed, declared or external, and an external claim cannot authorise a payment. Expiry: agent certificates lapse after 90 days, and a run that clears no depth drops the agent to depth 1 the same day.
What extra must approvers in regulated roles learn?
Regulation B is a good test of an approver. If an agent drafts a credit denial, the reasons must be specific and true to the decision. An approver who cannot see which facts drove the draft, and which bound held it, cannot confirm the reasons. The same logic applies to a claims denial reviewed under state insurance rules, or a model owner signing off under SR 11-7.
| Role | Agent work they oversee | What they must be able to do |
|---|---|---|
| Credit approver | Drafted decisions at depth 2 | Confirm specific, accurate reasons |
| Claims supervisor | Held payments at depth 4 | Check payee provenance before release |
| Model owner | Certification evidence and depth changes | Explain why the agent holds its depth |
| Healthcare IT administrator | Connections to patient systems | Limit access to the minimum necessary |
The operations manager brief for insurance in the US and the IT administrator brief for healthcare in the US cover two of these roles.
What does this look like in a US insurer?
Take a regional property insurer using an agent for claims. The agent reads the policy, sealed from the policy system, and the adjuster's notes, declared. It drafts a settlement at depth 2 and prepares payment at depth 4 for claims under the insurer's own limit. A contractor emails new bank details. The agent holds the payment because the change arrived from an external source. The supervisor who calls the contractor on a known number before releasing is doing exactly what training should produce.
How do you evidence training across states and regulators?
Keep one record per person that names the role, the capabilities overseen, the training, the result and the expiry, and link approval rights to a current credential. The append-only record of agent verdicts names who released each held action. Because examiners differ by sector and state, a credential that any of them can check at source saves repeated requests. The model is set out in AI literacy and certification for people who work with agents; the UAE guide shows a different multi-regime market.
Where the Academy fits
Pryme Intelligence Academy's Builder track suits model owners: it ends in a proctored exam and a capstone agent certified in Attest to depth 2 or higher. Approvers take the Operator track, and certificates are issued through VerifyDoc.ai for checking at source by any examiner.
Questions people ask
Is there a federal requirement for AI training?
There is no single federal AI law. Training duties come from sector rules, such as HIPAA workforce training, and from supervisors' expectations of competent oversight.
Does SR 11-7 apply to AI agents?
SR 11-7 is guidance on model risk for banks. Where an agent makes or shapes decisions, the prudent reading is to treat it as within scope, which brings validation, ownership and competent use with it.
Should state-level rules change the training?
Yes, where they apply. Add modules for the state privacy or AI laws that reach your customers, and test staff on cases from those states.