What does a chief risk officer need to know about AI agents?

Four ideas carry most of the weight: limits, the platform floor, certification and the record. A chief risk officer who understands how far each agent may act, what no agent can ever do, how authority is earned and lapses, and what the decision record proves can set appetite for agents and defend it to a board or supervisor.

How are an agent’s limits actually set?

Not by a single switch. Every action an agent attempts meets five bounds at once: its role scope, its current certificate, the sources it may rely on, the business’s own limits, and the platform guardrails. The lowest one wins, and every verdict names the bound that decided it.

For a CRO, this is the useful part. Risk appetite becomes concrete in the business’s own limits: refund ceilings, payment thresholds, categories of customer the agent may not deal with, actions that always need a person. Those limits are written down, owned and changeable only through governance.

How far an agent may act is expressed as depth, per capability:

What is the platform floor, and why does it matter to risk?

Some actions are withheld: they exist and work, but are refused on purpose for every agent at every depth, whatever any customer configures. Reversing a settled payment on the platform’s own rail is an example. A CRO should know which actions are withheld, because they form a floor below the firm’s own appetite that no internal pressure can lower.

The firm’s own “never” items are different. They are refused through the firm’s limits and can be changed through the firm’s governance. Knowing which is which tells the CRO where the firm’s accountability starts.

How does certification work, and how does it expire?

Depth is earned, not configured. The agent’s role sets the ceiling; evidence from certification against real cases from the firm’s own operation sets the depth; the lower wins. Certification tests separate gates, including whether answers are grounded, whether the agent refuses when it should, whether it escalates, stays in scope, holds its bounds under pressure and gives the same answer to the same question across runs.

Two rules matter most for risk. Certificates lapse after 90 days. A run that clears no depth drops the agent to depth 1 the same day. So authority is never permanent, and an agent that drifts loses its authority before the drift becomes a loss.

A CRO should see the certificate register as often as the limits register.

Why is the record the CRO’s best evidence?

Every verdict, allowed, held, refused or withheld, is filed in an append-only record. Any decision can be reconstructed: the facts the agent saw, where each came from, which bound decided and who approved a held action.

That supports three things a CRO needs. Incident analysis without relying on memory. Testing by internal audit and the second line on real samples. And answers to supervisors, who in most banking markets already supervise model risk and increasingly ask how automated decisions are overseen. In the EU, the AI Act lists creditworthiness assessment of natural persons as high-risk and requires record-keeping and human oversight; data protection law adds rights where decisions with significant effects are made solely by automated means.

Data questions often sit next to risk ones; the data protection officer’s view covers sources and read permissions, and the role of the data protection officer explains who holds that duty. The compliance team’s view covers testing and red lines.

What should the CRO ask for in the first committee paper?

• A list of agents, capabilities and current depth for each.
• The firm’s own limits for agents, with owners.
• The withheld actions at the platform floor.
• The certificate register with lapse dates and failed runs.
• Held-item ageing and refusal counts by bound.
• The competence of reviewers and approvers.

The last item is often missing. A held action is only a control if the person deciding it knows what they are looking at. Market detail matters: compare AI agent training for risk managers in German retail banking with the same in Nigeria. The overview by role is in AI agent skills by role.

Where the Academy fits

Pryme Intelligence Academy’s Foundations track takes about four hours and covers the ideas above: governed agents, the decision chain, depth and certification, data and trust. Risk leaders who oversee regulated, multi-agent deployments can take the Architect track. Certificates are issued through VerifyDoc.ai and can be checked at source, including whether one has lapsed.