# The AI agent lifecycle in a bank: eight gates Source: https://www.bankingnewsai.com/agentic-banking/lifecycle Last updated: Oct 19, 2026 ## 1. Intake **Gate:** What will the agent do, for whom, and what could go wrong? **Evidence** - Use-case statement naming the process, the users and the affected customers - The actions the agent will be allowed to take, listed - Initial harm analysis **Documents** - [Treasury AI in Financial Services report (Dec 2024)](https://www.bankingnewsai.com/ai-regulation/documents/treasury-ai-financial-services-report-2024) — Review each AI use case for compliance with existing law before deployment. - [Treasury FS AI RMF and AI Lexicon (Feb 2026)](https://www.bankingnewsai.com/ai-regulation/documents/treasury-fs-ai-rmf-and-ai-lexicon-2026) — Tools to evaluate AI use cases across the lifecycle. - [NIST AI RMF 1.0](https://www.bankingnewsai.com/ai-regulation/documents/nist-ai-100-1) — The Map function: context, intended use, affected parties. ## 2. Risk tiering **Gate:** Which tier, which autonomy level, which rulebook? **Evidence** - Materiality rating - Autonomy level (0–4) proposed and approved - Regulatory classification: model-risk scope, EU high-risk, consequential decision, consumer-facing **Documents** - [FSB AI sound practices (final report, Oct 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fsb-ai-sound-practices-2026) — Sound Practice 5: materiality and risk assessment before selection. - [SR 26-2](https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-26-2) — Materiality drives the intensity of validation and monitoring; generative/agentic out of scope. - [Regulation (EU) 2024/1689](https://www.bankingnewsai.com/ai-regulation/documents/eu-ai-act-regulation-2024-1689) — Annex III classification decides whether the full high-risk regime applies. - [SB 26-189](https://www.bankingnewsai.com/ai-regulation/documents/co-sb26-189) — 'Covered ADMT' — material influence over a consequential decision — triggers notice and review duties. ## 3. Design **Gate:** What is the permission envelope and where does a human sit? **Evidence** - Identity and entitlements specified - Tool allow-list, limits and approval points - Data scope and lineage plan - Oversight design: thresholds, reviewers, recourse **Documents** - [CAISI RFI on AI agent security (2026)](https://www.bankingnewsai.com/ai-regulation/documents/nist-caisi-rfi-ai-agent-security-2026) — Constraining and monitoring agent access designed in, not bolted on. - [Regulation (EU) 2024/1689](https://www.bankingnewsai.com/ai-regulation/documents/eu-ai-act-regulation-2024-1689) — Human oversight (Art. 14) and logging (Art. 12) are design requirements for high-risk systems. - [NIST AI 600-1 (Generative AI Profile)](https://www.bankingnewsai.com/ai-regulation/documents/nist-ai-600-1) — Suggested actions per generative-AI risk to select from at design time. ## 4. Build and onboard **Gate:** Do we know what we are buying, and can we leave? **Evidence** - Vendor due diligence and contract terms (data use, audit, incident notification, exit) - Secure development evidence; human review of AI-generated code - Component inventory including models, retrieval stores and tools **Documents** - [SR 23-4](https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-23-4) — Planning, due diligence, contract negotiation and exit for vendor AI. - [BCBS Third-Party Risk Principles (Dec 2025)](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-third-party-risk-principles-2025) — Due diligence, binding contracts, nth-party and concentration risk. - [DFS Frontier AI Models Industry Letter (May 2026)](https://www.bankingnewsai.com/ai-regulation/documents/ny-dfs-industry-letter-2026-05-21-frontier-ai-models) — Human oversight of AI-generated code before deployment. - [ESA Statement on ICT risks from frontier AI models (JC 2026 25)](https://www.bankingnewsai.com/ai-regulation/documents/esas-jc-2026-25-frontier-ai-statement) — Inventories that include AI/ML components; secure-by-design. ## 5. Validate and test **Gate:** Does it do what we approved, and what happens when attacked? **Evidence** - Evaluation results against the approval metrics - Adversarial and red-team testing (prompt injection, poisoning, specification gaming) - Independent validation for any in-scope model the agent calls **Documents** - [SR 26-2](https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-26-2) — Independent validation with outcomes analysis and effective challenge for in-scope models. - [NIST AI 100-2e2025 (Adversarial ML)](https://www.bankingnewsai.com/ai-regulation/documents/nist-ai-100-2e2025) — Adversarial machine-learning taxonomy for attack-oriented testing. - [PRA SS1/23](https://www.bankingnewsai.com/ai-regulation/documents/pra-ss1-23-model-risk-management) — Independent validation principle, including vendor models. - [FCA FS25/5](https://www.bankingnewsai.com/ai-regulation/documents/fca-fs25-5-ai-live-testing) — Supervised live testing as a path to production for AI in UK financial services. ## 6. Approve and deploy **Gate:** Who signs, and is the oversight actually configured? **Evidence** - Sign-off by the accountable owner and the second line - Staged rollout with rollback - Oversight thresholds, reviewers and kill switch verified in production **Documents** - [Machado speech: 'Technology is neutral, governance is not' (Feb 2026)](https://www.bankingnewsai.com/ai-regulation/documents/ecb-machado-technology-neutral-governance-speech-2026) — Accountability for AI outcomes and effective challenge before use. - [FSB AI sound practices (final report, Oct 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fsb-ai-sound-practices-2026) — Sound Practice 2 governance and accountability; SP10 human oversight. - [Regulation (EU) 2024/1689](https://www.bankingnewsai.com/ai-regulation/documents/eu-ai-act-regulation-2024-1689) — Deployer duties: use per instructions, ensure oversight, monitor operation (Art. 26). ## 7. Operate and monitor **Gate:** Is it still doing what we approved? **Evidence** - Traces retained; drift and performance dashboards against approval metrics - Security alerting for anomalous behaviour - Oversight metrics: override rate, escalations, time-to-human **Documents** - [Regulation (EU) 2024/1689](https://www.bankingnewsai.com/ai-regulation/documents/eu-ai-act-regulation-2024-1689) — Automatic logging and six-month retention for deployers. - [ESA Statement on ICT risks from frontier AI models (JC 2026 25)](https://www.bankingnewsai.com/ai-regulation/documents/esas-jc-2026-25-frontier-ai-statement) — Move from periodic to continuous monitoring. - [Division of Examinations FY2026 Priorities](https://www.bankingnewsai.com/ai-regulation/documents/sec-exam-priorities-fy2026) — Examiners test policies to monitor and supervise AI in operation. - [FSB AI sound practices (final report, Oct 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fsb-ai-sound-practices-2026) — Sound Practice 9: ongoing monitoring. ## 8. Change, incident and retirement **Gate:** What changed, what broke, and when do we re-assess? **Evidence** - Re-assessment triggers: vendor model update, new use, new rule, incident - Incident playbook with regulatory notification paths - Exit executed per plan; entitlements revoked; data handled per retention **Documents** - [Treasury AI in Financial Services report (Dec 2024)](https://www.bankingnewsai.com/ai-regulation/documents/treasury-ai-financial-services-report-2024) — Re-evaluate AI use cases periodically, not once. - [SB 26-189](https://www.bankingnewsai.com/ai-regulation/documents/co-sb26-189) — Developers must notify deployers of material updates; deployers re-assess. - [BCBS Principles for Operational Resilience (2021)](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-principles-operational-resilience-2021) — Incident management and recovery as a critical-operations discipline. - [SR 23-4](https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-23-4) — Termination and exit as a lifecycle stage of third-party risk. --- Canonical page: https://www.bankingnewsai.com/agentic-banking/lifecycle Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (43 authorities, 244 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.