Agent assurance
When an agent does something a firm has to answer for, a named person answers for it. We tell that person what their agent actually does, and where that differs from what they have been told. Then we build the records so they stop having to ask.
What we do
Most firms start with a single agent, because it is the cheapest way to find out whether the records they hold can answer the question.
Three tiers. Reading the records, asking the accountable owners, then rebuilding the agent independently from your own code and running it.
Sold separately. You can stop after any one of them.
The assessmentThe twelve records a firm needs about each agent, mapped onto the registers and inventories you already hold, with the gaps filled and the quality checked.
Done at design time, the questions stop being investigations.
The buildAIscale also runs AI governance and data management as a service, provides fractional data leadership, licenses a data governance platform that builds an inventory from the documentation you already hold, and trains teams. None of that is written up here yet. The number above reaches us for any of it.
Why now
Each one lands in the same place: a named person inside the firm, answerable for what an agent does.
“Ultimate accountability sat with the SMF responsible for the business area the tool would operate in.”
From its good and poor practice on AI in financial services. A separate model owner oversaw the technical build.
“Each Agentic A.I. deployment should have a clearly designated accountable owner, normally the relevant business owner.”
From its discussion paper on agentic A.I. governance in banking, supported by technical and control role-holders. Consulting until 1 February 2027, and its views are exploratory rather than binding.
“Diffuse ownership or insufficient technical fluency limiting effective oversight and challenge.”
Named as a risk in its supervisory framework, which describes identifying accountable executives and use-case owners.
None of this creates accountability. In the UK the Senior Managers Regime already put it on a named person. What has changed is what that person is accountable for. The FCA is precise about the standard: it does not expect senior managers to be technical specialists, and it does expect them to take reasonable steps to understand the risks arising from AI use in their area.
What an assessment compares
Three of them are already written down. The fourth is in somebody’s head until a person goes and asks for it, and it is the one that carries the exposure.
The model
The Control Evidence Object Model. Twelve objects: eight you maintain and version, four you capture once and never revise. Licensed CC BY 4.0 with a DOI, so anyone can use it on their own agents without us.
Who we are
Agent assurance is new. The judgement behind it is not. A career as a Chief Data Officer and supporting Chief Data Officers, as a data and AI control expert in regulated firms.
Knowing which records a firm really holds, which are maintained and which are quietly stale, is the whole job in every line of work on this site.