US, UK and Canadian regulators take different positions on AI agents, but all ask the same ten questions, and one case-level evidence trail can answer them. It is for risk, compliance, technology and operations leaders who need to test an agent against those questions and close the gaps.
This paper establishes that the three regulators that matter most to financial firms working across the US, the UK and Canada have taken different positions on AI agents, yet ask the same underlying questions: what the agent did, under whose authority, how the firm knew it was still working, and what it did when it was not. One evidence trail, written as the work happens, can answer all three.
Where are firms weakest with AI agents?
After launch. The Bank of England and FCA's 2026 survey, covering 196 UK firms with 105 completing the full survey, found 80% of responding firms have agents deployed. Human review for higher-risk uses and pre-deployment privacy and security review are each reported by 95%. Periodic review is reported by 51% and incident response playbooks by 49%.
Suppliers add to the problem. Third-party systems make up 53% of the AI systems firms rate as high-materiality, up from 35% in 2024. Firms report deep knowledge of 77% of high-materiality systems they built and 24% of those they bought.
What has each regulator said?
- United States: the Federal Reserve, OCC and FDIC issued revised model risk guidance on April 17, 2026, replacing SR 11-7, and placed generative and agentic AI outside it. Banks are still expected to govern agents under their own risk management.
- United Kingdom: no new AI rules. Consumer Duty, the Senior Managers and Certification Regime, operational resilience and outsourcing rules apply.
- Canada: OSFI Guideline E-23 covers AI models at all federally regulated institutions from May 1, 2027. A July 2026 bulletin sets out sound practices for agents, including identities, permissions, approval checkpoints and logging.
What does the evidence trail contain?
The unit of evidence is the case, not the system. Each record holds what came in, what the agent did, which model and tool versions ran, who approved, what changed in the system of record, and proof that the log is intact. The paper adds three design rules: write it as the work happens, keep it outside the agent, and make it readable by a non-engineer.
Key takeaways
- Approval before launch is near universal among UK firms, at 94% to 95%, but periodic review is reported by 51% and incident playbooks by 49%.
- 80% of responding UK firms use agents for decision support, while only 2% report broad autonomy with limited real-time human involvement.
- US agencies' April 2026 model risk guidance leaves generative and agentic AI out of scope, so banks must govern agents under their own risk management framework.
- OSFI Guideline E-23 applies to AI models at all federally regulated institutions from May 1, 2027, and a July 2026 bulletin addresses agents by name.
- UK firms report deep knowledge of only 24% of the high-materiality AI systems they bought, and rely on vendor assurance for 81% of them.
- Questions 7 to 10 of the paper's ten supervisor questions cover monitoring, sign-off, stopping the agent and supplier failure, and none can be done once and filed.
What is in the full paper
- Executive summary
- Where firms are: agents are live, controls thin out after launch
- The rules: three regulators, three positions
- The common ground: ten questions every supervisor will ask
- After go-live: the four controls most firms are missing
- The answer: one evidence trail
- The plan: the runway to May 1, 2027
- How ETT Group helps
- Next steps
The full paper has the figures, the sources and the working.
Download the PDF
