The senior manager whose business area the agent works in. SM&CR has no special role for AI. If an agent handles complaints, the senior manager responsible for complaints answers for it; if it underwrites loans, the one responsible for lending does. Technology and risk senior managers carry supporting responsibilities. The allocation must be explicit and written down.
How does SM&CR assign accountability?
The Senior Managers and Certification Regime makes named individuals accountable for areas of a regulated firm's business. In substance:
- Senior managers hold approved functions and have documented responsibilities, recorded in a statement for each person and in the firm's map of responsibilities.
- Responsibilities follow the business. Whoever is responsible for an activity is responsible for how it is carried out, including through technology and outsourced services.
- A duty of responsibility means a senior manager can be held to account if a breach happens in their area and they did not take reasonable steps to prevent it.
- The certification regime covers staff in roles that could cause significant harm, whom the firm must assess as fit and proper.
Applied to agents, the question is not "who owns AI" but "whose activity is the agent performing". The longer analysis is in SM&CR: which senior manager owns an AI agent.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Why is an agent harder to allocate than a system?
A traditional system supports a process; the process owner is clearly accountable. An agent can span processes. A customer agent may answer queries (customer service), apply fee refunds (operations), recognise vulnerability (conduct) and spot fraud (financial crime). Each capability sits in a different senior manager's area.
That creates two risks. Gaps, where everyone assumes someone else owns the agent. Dilution, where a single "AI owner" is named who has no authority over the business activities the agent performs. Both fail the reasonable steps test. The principle is argued in senior managers remain accountable for what agents do.
Who holds what?
| Role | Accountable for | Records it in |
|---|---|---|
| Business senior manager for each activity | The agent's conduct and outcomes in that activity | Their statement of responsibilities; the responsibilities map |
| Senior manager for technology or operations | Platform resilience, access, change and outsourcing | Their statement; outsourcing records |
| Senior manager for risk | Oversight of agent risk across the firm | Risk framework |
| Senior manager for model risk (banks under PRA SS1/23) | The model risk framework that agents fall within | Model risk policy |
| Certified staff who approve held actions | Their own approvals | Certification records |
What the agent may do is set by the business senior manager: its depth for each capability, which actions are held, and when it is stopped. What stays with people is the approval of held actions and every judgement the firm has kept back from the agent.
An illustrative example
Take a UK retail bank deploying an agent across card servicing. It can answer queries, refund fees up to a limit, raise disputes and flag possible fraud. The bank's first draft named its chief data officer as the agent's owner.
On review, the bank allocates by capability. The senior manager for retail operations owns queries, refunds and disputes, and the agent appears in that manager's statement of responsibilities. The senior manager for financial crime owns the fraud flagging capability. The chief operating officer holds responsibility for the platform's resilience and the outsourcing to the model provider. Each senior manager approves the depth for their capabilities and receives monthly outcome reports. When the fraud capability starts holding too many genuine payments, it is clear whose decision it is to change it.
What counts as reasonable steps?
Reasonable steps for an agent usually include:
- approving each capability's depth based on test evidence;
- setting limits and holds for actions in their area;
- receiving outcome and incident reports, and acting on them;
- making sure the staff who approve held actions are competent;
- making sure the agent can be stopped quickly.
How these are evidenced is covered in SM&CR reasonable steps when an AI agent acts. Related questions are answered in who is accountable when a bank's AI agent makes a mistake. The full map is in AI agent regulation, mapped to controls.
Questions people ask
Should we create a senior manager role for AI?
There is no prescribed function for AI. Some firms give one senior manager oversight of AI governance, but that must not replace the accountability of the business senior managers whose activities agents perform.
Is the vendor's management accountable under SM&CR?
No. SM&CR applies to the regulated firm's own senior managers. Outsourcing does not move accountability.
What if an agent's capabilities change?
Update the allocation. A new capability may fall in a different senior manager's area, and their statement and the responsibilities map should reflect it before the capability goes live.