Will AI agents replace risk managers?

No. Agents add a new category of risk to manage, so risk managers have more to do, not less. An agent can draft the risk report and monitor indicators. But setting appetite, challenging the business and deciding how far agents may act are judgements a risk function exists to make, and the board expects a named person to make them.

What does a risk manager do that an agent cannot?

A risk manager's value lies in challenge. They look at a plan the business likes and ask what happens if it goes wrong. They weigh probability against impact when the data is thin. They tell a senior executive that a proposal sits outside appetite. An agent can assemble evidence for that challenge; it cannot carry the authority to make it.

Risk managers also decide what counts as acceptable. Appetite is a choice made by people accountable to a board, not a calculation.

What can the agent take on?

• Monitoring. Watching key risk indicators against thresholds and drafting alerts (depth 1 and 2).
• Incident logging. Drafting incident records from operational reports, with the source of each fact (depth 2).
• Risk register upkeep. Proposing updates to risk ratings where indicators have moved, held for the owner (depth 2).
• Reporting. Drafting the monthly risk report and the commentary on trends.
• Control testing support. Pulling evidence for control owners' self-assessments.

What stays with the risk manager?

• Setting and interpreting risk appetite.
• Approving changes to risk ratings and accepting risks.
• Challenging first-line decisions, including decisions to deploy agents.
• Deciding the limits that govern agents, alongside the business.
• Escalation to senior management and the board.
• Judgement on emerging risks with no history.

Related roles see a similar shift; see whether agents will replace operations managers and whether agents will replace property managers.

How do agents become a risk to manage?

Every agent action meets the minimum chain: role scope, certificate, sources, the customer's own limits and the platform guardrails, with the lowest bound deciding. The customer's own limits are where the risk function has the most say. A risk manager who understands the chain can set limits that match appetite: a claims agent may settle up to a set value, never decline; a payments agent may repair but not release.

Risk managers also need to watch for things that do not show up in traditional indicators. Are reviewers approving held actions too quickly? Has a source gone stale? Did an agent drop to depth 1 after a certification run that cleared no depth, and did the business cope? All of this is visible in the append-only record of verdicts. Frameworks such as the NIST AI Risk Management Framework, with its Govern, Map, Measure and Manage functions, and ISO/IEC 23894 give structure to the work.

What does it look like at an insurer?

Take an insurer planning to let its claims agent settle small property claims at depth 4. The business case shows faster settlement and fewer handler hours. The agent drafts the risk assessment from the certification results.

The risk manager reads further. The certification cases were drawn from a period with no major weather event. After a storm, claim volume and fraud attempts both rise, and the agent has not been tested on that pattern. The risk manager approves depth 4 with two conditions: a lower settlement limit after any declared catastrophe event, and a recertification run including storm-period claims. The business gets most of its benefit; the risk sits inside appetite. Insurance supervision differs by market; see AI agent training for risk managers in insurance in Japan and in Spain.

What must risk managers learn?

They need to understand depth and how it is earned, the minimum chain, the four verdicts and what makes an action withheld rather than refused, how certificates lapse, and how to read the record. Without that, they will be reviewing agent risk through slide decks prepared by the people who want to deploy. The case for the risk manager as a decisive control is in why risk managers are the real control.

Where the Academy fits

Risk managers start with Pryme Intelligence Academy's Foundations track, which covers why agents must be governed, the decision chain and depth and certification. Those who oversee regulated, multi-agent deployments can work towards the Architect track, which ends in a capstone and a board review with two Pryme assessors. The guide to AI agent skills by role places risk among other roles.