# AI Agent Production Approval — Risk Committee Checklist

Version 1.0 · 2026-08-24 · https://kla.digital/blog/ai-governance-banking-2026-guide

Use one checklist per AI agent per Process. The committee approves only when every gate is PASS or
carries a written, time-boxed condition with a named owner. General information only; confirm
institution-specific obligations with qualified legal and supervisory counsel.

## Identification

- AI system name and version:
- Process and business outcome:
- AI system owner (named individual):
- Process owner (named individual):
- Jurisdictions and customer segments:
- Requested validity period (12 months maximum recommended):

## The ten launch gates

For each gate record: PASS / CONDITION / FAIL, the accountable approver (name and role), the
evidence reviewed (document or record reference), and the date.

1. Approved use case and legal classification
   - Intended purpose recorded; provider/deployer role analysis complete; classification decision
     with rationale (including any EU AI Act Annex III analysis and carve-outs relied on).
   - Approver: Business owner with Compliance and Legal.

2. Named accountability
   - AI system owner and Process owner on record; decision-rights matrix approved; second-line
     challenge recorded.
   - Approver: Chief Risk Officer or delegated risk owner.

3. Validated models and providers
   - Model validation or governance-basis determination consistent with SR 26-2 scope boundaries;
     vendor due diligence; concentration and exit analysis.
   - Approver: Model Risk with Third-Party Risk.

4. Bounded mandate and entitlements
   - Permitted actions, tools, data boundary, transaction and aggregate limits; least-privilege
     review; revocation tested.
   - Approver: Process owner with Security.

5. Versioned policy with fail-closed outcomes
   - Approved policy version identified; demonstrated deny on policy-service failure; confirmed
     that no configuration converts an evaluation failure into an allow.
   - Approver: Second-line risk.

6. Human decision capacity
   - Reviewer roster and authority; maker-checker enforcement; queue-capacity test; approval
     expiry windows defined.
   - Approver: Decision Desk owner (or equivalent approval-queue owner).

7. Negative-path test results
   - Bypass, outage, changed-parameter, stale-approval, replay, and retry tests executed on the
     real workflow with transcripts retained. Reference procedure: the AI Agent Runtime Governance
     Capability Test Suite (RT-01 through RT-09),
     https://kla.digital/research/ai-agent-runtime-governance-test-suite
   - Approver: Technology owner with second-line review.

8. Monitoring and intervention plan
   - Thresholds, signal owners, response clocks, rollback criteria; kill switch tested.
   - Approver: Process owner with risk owner.

9. Incident and resilience readiness
   - Failure-mode tests, fallback operation, recovery objectives; incident classification and
     notification mapping (including DORA clocks where applicable).
   - Approver: Operational resilience owner.

10. Evidence contract and retention
    - Evidence contract in force; sealed records independently verified; retention basis and
      legal-hold path confirmed.
    - Approver: Compliance with Internal Audit.

## Conditions and exceptions

| Condition | Gate | Owner | Closure date | Accepted by (risk owner) |
|---|---|---|---|---|
|  |  |  |  |  |

Rule: an open condition without a named owner and closure date is a FAIL.

## Expiry and re-approval

- Approval expiry date:
- Re-approval triggers (any of these voids the approval before expiry):
  - Model or provider version outside the approved set
  - Expanded mandate, tool, or data boundary
  - Weakened policy or threshold
  - New jurisdiction or customer segment
  - Accepted monitoring breach
  - Incident at or above the agreed severity

## Decision

- Committee decision (approve / approve with conditions / decline):
- Approvers (name, role, date):
- Evidence pack reference:
- Minute reference:

A completed sample record is available at
https://kla.digital/downloads/ai-agent-risk-committee-approval-record-sample.md