Can an AI agent hold regulated responsibility under the UK SM&CR?

No. An AI agent cannot hold regulated responsibility under the UK Senior Managers and Certification Regime. The SM&CR allocates responsibility to named human senior managers through statements of responsibilities, and an AI agent cannot hold a senior management function. Every action an agent takes therefore lands on the statement of responsibilities of a human being, which turns the question from a legal novelty into an evidential one.

The question matters in 2026 because agentic AI is moving from pilots into workflows that touch regulated activity, and the accountability regime has not moved with it. The senior manager remains the person the FCA will ask.

Who answers for an agent's actions under the SM&CR?

The human whose statement of responsibilities covers the business area in which the agent operates. The regime was built after the financial crisis precisely to stop responsibility dissolving into systems and committees. Delegation to an AI agent is still delegation: the senior manager conduct rules require reasonable steps to ensure the business is controlled effectively, and that duty does not transfer to software. An agent is a mechanism through which a senior manager acts, not a colleague to whom accountability can pass.

What does the reasonable steps defence require in practice?

When something goes wrong, a senior manager's protection is evidence of reasonable steps: that the delegation was sensible, the controls were real and the oversight actually happened. Applied to agentic AI, that translates into concrete artefacts:

• A written definition of what the agent may and may not do, enforced by permissions rather than policy documents.
• Per-action identity, so every step is attributable to that agent, that version and that mandate.
• A sealed, append-only log of every agent step, covering what it read, what it decided and what it executed.
• The ability to replay a decision after the event, with the inputs the agent saw at the time.

A senior manager who can produce those four artefacts has a defensible account. One who cannot is accountable for a record they do not hold.

What does a defensible agent record look like?

It must be independent of the people and vendors involved. In our architecture every agent carries its own cryptographic identity, distinct from the human who commissioned it, and every action is sealed into an append-only audit ledger signed under FIPS 204, the primary post-quantum digital signature standard. The record verifies offline: a compliance officer, an internal auditor or the regulator can check the sequence of actions without trusting the firm's operational systems and without any external service being available. Hardware-attested identity binds the record to the machine that produced it. Mickai is a Sovereign Intelligence Operating System, a SIOS, and runs this pattern offline on hardware the firm owns.

Why does an agent in a vendor's cloud create an accountability gap?

An agent whose actions run through a vendor's cloud leaves its evidence in someone else's estate. The firm holds prompts and outputs; the intermediate steps, retrievals and internal decisions exist, if at all, in provider logs governed by the provider's retention schedule and disclosed on the provider's terms. When the FCA asks why the agent acted, the accountable senior manager is relying on a third party's records to discharge a personal regulatory duty. A contractual right to audit is not the same as holding the record, and a provider's assurance is not a technical guarantee. That gap may be tolerable for low-stakes automation. It is a poor place to stand for anything touching regulated activity.

How should firms bound what an agent is allowed to do?

Bounding is the control regulators will recognise, because it mirrors how human mandates work. An agent should hold the narrowest set of permissions that lets it do its job, assigned explicitly, expiring by default and enforced at the point of action. In practice the agent authenticates per action rather than per session, its permissions are versioned so the mandate in force at any moment is knowable, and any step outside the mandate fails closed and is logged. Cross-model consensus adds a further control for higher-stakes steps: more than one model must agree before an action executes, which converts a single model's error into a logged disagreement rather than an executed mistake.

What should a senior manager ask before signing off an agent?

Before accepting an agent into a business area, a senior manager should be able to answer five questions in writing:

• What exactly is the agent permitted to do, and what enforces the boundary?
• Where does every step of its activity get recorded, and who controls that record?
• Can a decision be replayed with the inputs the agent saw at the time?
• What happens when the agent attempts something outside its mandate?
• If the vendor disappeared tomorrow, would the evidence survive?

If any answer depends on goodwill rather than architecture, the delegation is not ready for a regulated environment.

“Accountability under the SM&CR cannot be delegated to software, so the record of what the software did becomes the senior manager's shield.”

How agent identity, the sealed ledger and the studios fit together is set out at /sovereign-ai, and the film at /film shows the interface in operation.

Frequently asked questions

Can an AI agent be a senior manager under the SM&CR?

No. Senior management functions under the regime are held by approved human individuals with statements of responsibilities. An AI agent has no legal personality and cannot be approved to a function, so its actions are attributed to the human senior manager responsible for the relevant business area.

Am I personally accountable if an AI agent in my area makes a bad call?

The accountable senior manager for the business area carries the regulatory exposure, subject to the reasonable steps assessment. The practical protection is evidence: bounded permissions, a sealed per-action log and the ability to replay the decision. With that record a defensible account exists; without it, the manager is defending a judgment they cannot reconstruct.

What records should we keep of AI agent activity for the FCA?

Keep the mandate in force at the time, the full sequence of agent actions with per-action identity, the inputs each decision saw and the outputs executed, all in an append-only record the firm itself controls. A record held only in a vendor's cloud is a dependency, not an asset, when a regulator asks questions.

Does using an AI agent count as outsourcing under FCA rules?

Where the agent runs on a third party's infrastructure, firms should assess it against outsourcing and operational resilience expectations, because a material dependency exists. Where the agent runs on the firm's own hardware inside its own perimeter, the dependency surface is smaller and the assessment simpler. Either way the accountability of the senior manager is unchanged.

Can cross-model consensus reduce regulatory risk from AI agents?

It reduces the chance that a single model's error becomes an executed action, because higher-stakes steps require independent models to agree before anything runs. Regulators do not mandate the technique, but it maps naturally onto the four-eyes controls supervisors already understand, and every disagreement it catches is logged evidence of a functioning control.