A compliance analyst who understands governed agents is well placed for the control side of AI operations. In retail banking the fits are AI governance analyst, AI risk analyst, policy owner for agent limits and compliance reviewer of agent output. Later, owning a compliance agent is realistic. These roles run on asking "where is the evidence?".
Why do banks want compliance people around agents?
Because agents act, and actions in a bank are regulated. Several rules bear directly on how agents are run. The EU AI Act lists creditworthiness assessment and credit scoring of natural persons as high-risk uses, with human oversight under Article 14 and record-keeping under Article 12. In the US, ECOA and Regulation B require specific reasons when credit is denied, including when a model is used. Model risk is supervised in most banking markets, and anti-money-laundering work follows the FATF's risk-based approach.
Someone has to turn those expectations into controls an agent meets at the moment of action, and then prove it. That is compliance work with a new subject.
Which jobs open up?
| Job | What you would do | What carries over |
|---|---|---|
| AI governance analyst | Keep the inventory of agents, track certificates, test controls, assemble evidence | Control testing, evidence, regulatory mapping |
| AI risk analyst | Assess and challenge the risks of each capability; report to committees | Risk assessment, independent challenge |
| Policy owner for agent limits | Write the rules agents must hold or refuse, in testable form | Policy drafting |
| Compliance reviewer of agent output | Check customer communications and decisions the agent drafts | Communications review, regulatory knowledge |
| Agent owner for compliance agents | Answer for an alert-triage or screening agent's limits and incidents | Knowledge of monitoring and escalation |
Titles vary. Look for duties such as AI controls, model or agent risk, automated decision oversight and evidence for audit.
What does a compliance catch look like?
Take an analyst we will call Bea at a retail bank with a US lending book. The lending agent drafts decline letters for small personal loans, and a person approves each one. Her quarterly test samples twenty approved letters.
Most cite specific reasons drawn from the decision record, such as income below the threshold for the amount requested. Four say only that the application "does not meet our lending criteria". Those four were approved by a reviewer who was new to the team. Under Regulation B, a generic reason like that is not enough. Bea raises a finding, the letters are reissued with specific reasons, the reviewer is coached, and the agent's brief is changed so that it cannot draft a decline without naming the factors that decided it. The bank's own limits now refuse a letter missing them.
What should a compliance analyst add?
- How governed agents decide: depth, the minimum chain of bounds, the four verdicts.
- Provenance: which facts are sealed, signed, declared or external, and which decisions need which.
- Certification and expiry: how a capability earns authority on the bank's own cases and loses it if not renewed.
- Reading decision records: every verdict is filed in an append-only record, which is your evidence base.
- Frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001, which many banks use to structure AI governance.
How do you make the move?
If your bank is deploying agents, ask to join the control design for the next capability. If not, build evidence of understanding how agents are governed, and show it alongside your compliance record. The detailed route is in how to become an AI operations analyst as a former compliance analyst and how to move from compliance analyst to AI agent reviewer. Neighbouring roles are covered in what jobs a KYC analyst can get with AI agent skills. The guide to AI agent jobs and careers maps the field.
Where the Academy fits
Pryme Intelligence Academy's Foundations track covers governance, certification and data and trust in about four hours, free. Compliance analysts heading for governance often take the Operator track to understand live review, then the Architect track, which covers regulated, multi-agent deployments and ends in a board review with two Pryme assessors.
Questions people ask
Is AI governance just compliance with a new label?
It uses the same disciplines, but the subject is different. Agents act at speed and earn authority on evidence, so governance must check certificates, limits and records continuously, not only in periodic reviews.
Do I need technical skills?
Not deep ones. You need to understand what an agent may do and what evidence should exist. Builders handle technical changes.
How do I present this to an employer?
Show controls you designed or tested and findings you raised, then show you understand agents specifically. The cover letter template for compliance analysts applying for AI operations jobs gives a structure.