Get started
Draft

AI Agents

Working draft · Version 1 · Research date 2026-09-28

1. Purpose and scope

This policy covers AI agents: software that talks with customers, reviews cases, makes or suggests decisions, or writes messages for the company, even when a person checks its work. It sets how the company knows each agent, checks its risks, tells people when they are dealing with AI, keeps a person in the decisions that matter, watches the agents at work and keeps what they did.

It applies to agents the company builds and to agents it buys from a provider. Decisions about hiring and staff, and the duties of companies that build AI for others, are outside this draft.

2. Adoption and accountability

The accountable policy owner must confirm the legal entity, products, customer locations, applicable laws and exemptions before adoption. Name an owner for the AI program and a person who answers for each agent, and obtain management approval of procedures, owners, retention and deadlines. This template does not claim legal review or complete compliance coverage. An answer about AI agents suggests scope; it is not evidence of a legal duty.

3. Operating controls

3.1 Keep an inventory of AI agents and who answers for each

Owner: AI program owner. Trigger: Before an agent starts work, and when its job, model, instructions or data change.

Every AI agent the company uses is listed before it starts work, with its job, the data it sees, its provider and model, the person who answers for it and the date of its last review. The entry changes when any of them does.

Evidence: AI agent inventory.

3.2 Check each AI agent's risks before it starts and after big changes

Owner: AI program owner. Trigger: Before an agent starts work, and after any change to its model, instructions, data or job.

Before an AI agent starts work, and after any change to its model, instructions, data or job, a documented review covers what could go wrong for customers, the controls that address it, the test results and who signed off. The agent stays off live work until the review is signed off.

Evidence: AI agent risk review.

3.3 Tell people when they are dealing with AI, and how to reach a person

Owner: Customer experience lead. Trigger: Each conversation, call or message an AI agent has with a customer or applicant.

People who chat, write or talk with an AI agent are told at the start that it is AI, and told how to reach a person. Calls that use an AI voice need the consent the telephone rules require and identify the caller.

Evidence: Approved notice wording and dated conversation samples.

3.4 Send complaints, disputes and requests for a person from AI conversations to your team

Owner: Compliance Officer. Trigger: Each complaint, dispute or request for a person made to an AI agent.

An AI agent recognizes a complaint, a dispute or a request for a person and keeps the conversation, and the case reaches its owner the same day, on the same clocks as the channel the agent replaces. A dispute raised in a chat may start a legal clock.

Evidence: AI conversation cases.

3.5 Explain decisions an AI makes or suggests, and offer a review by a person

Owner: Decision owner. Trigger: Each decision about a customer that AI makes or shapes.

When AI makes or shapes a decision about a customer, the company can give the specific reasons for it, sends the notices the law requires with those reasons, and lets the customer ask a qualified person to review it. For insurance underwriting and pricing, Insurance AI and underwriting governance holds the detailed controls.

Evidence: Decision reasons, notices and review requests.

3.6 Test AI decisions for unfair treatment before use and on a schedule

Owner: Model risk reviewer. Trigger: Before first use, after material changes, and on the schedule the company sets.

Outcomes of decisions that AI makes or shapes are tested for differences across protected groups before first use, after material changes and on a set schedule, and the method, results, fixes and sign-off are kept. The schedule is a company control, not a legal interval.

Evidence: Fairness testing report.

3.7 Watch AI agents at work and pause one that goes wrong

Owner: AI program owner. Trigger: While an agent is at work, with samples on the schedule the company sets.

What each AI agent says and does is sampled on a set schedule and checked against set warning signs, and a named person can pause an agent and review its work before it resumes.

Evidence: Monitoring samples and pause records.

3.8 Keep a record of what each AI agent said and decided

Owner: Records owner. Trigger: Each conversation, output and decision that reaches or affects a customer.

Conversations, outputs and decisions of AI agents that reach or affect customers are kept with the inputs and model versions used, for as long as the records they belong to must be kept.

Evidence: AI agent records.

3.9 Back up every claim you make about your AI

Owner: Marketing compliance reviewer. Trigger: Before any statement about the company's AI is published or used in sales.

What the company says about its AI in ads, sales and investor material is true, current and supported by evidence of what the AI does before it is used.

Evidence: Claim support file.

3.10 Review AI-written communications with investors as securities rules require

Owner: Registered principal. Trigger: Before an AI-written retail communication is used, and for each AI chat reply to investors.

For broker-dealers and investment advisers, AI-written retail communications get a principal's approval before use, AI chat replies to investors are supervised as correspondence, and both are kept under the books and records rules.

Evidence: Communications approvals and retained replies.

4. Exceptions, review and records

Log deviations with the affected agent, control, risk, interim action, owner and resolution date. Escalate a missed legal duty immediately to the responsible compliance lead; internal exceptions cannot waive law. Keep versioned approvals and follow the confirmed retention schedule and any legal hold. Review this policy after material legal, product or operating changes, and when an agent's job changes.

5. Authorities and limitations

  • FINRA Regulatory Notice 24-09: supervision, communications and records obligations apply to generative AI.
  • NAIC Model Bulletin, Use of Artificial Intelligence Systems by Insurers (December 2023), where a state has adopted it.
  • Regulation B (12 CFR 1002.4, 1002.9 and 1002.12), Regulation E (12 CFR 1005.11) and the FCRA (15 U.S.C. 1681m).
  • Cal. Bus. & Prof. Code §17941, Cal. Health & Safety Code §1339.75, and the FCC ruling on AI voices.
  • 45 CFR 92.210 for covered health programs.
  • Section 5 of the FTC Act (15 U.S.C. 45) and FINRA Rules 2210, 3110 and 4511.
  • The NIST AI Risk Management Framework, which is voluntary.
  • Research as of 2026-09-28; confirm the current operative requirements, including state AI laws that may change or be challenged.
  • Template status: draft, awaiting organization-specific and legal review.
  • Company review cadences, monitoring samples, operational steps and evidence examples are proposed implementation controls, not quotations from law.