# Sample Committee Record — AI Agent Production Approval

This is a fictional, completed example of the approval record a bank risk committee can adopt. All
names, figures, and references are invented for illustration. Template and gate definitions:
https://kla.digital/downloads/ai-agent-risk-committee-approval-checklist.md

---

**Institution:** Example Bank S.A. (fictional)
**Committee:** Non-Financial Risk Committee, meeting 2026-09-14, item 4.2
**System:** AML Alert Triage Agent v2.3 (internal build 2.3.1)
**Process:** Financial-crime alert triage, retail payments, EU booking entities
**AI system owner:** Head of Financial Crime Technology (I. Rossi)
**Process owner:** Head of AML Operations (M. Laurent)
**Requested validity:** 12 months

## Gate results

| # | Gate | Result | Approver | Evidence reviewed |
|---|---|---|---|---|
| 1 | Use case and legal classification | PASS | Business owner; Compliance; Legal | Use-case record UC-114; deployer-role analysis; classification memo LGL-2026-081 (fraud-detection carve-out reasoning retained) |
| 2 | Named accountability | PASS | CRO delegate | Decision-rights matrix v4; second-line challenge note 2026-08-30 |
| 3 | Models and providers | PASS | Model Risk; Third-Party Risk | Governance-basis determination GB-77 (agentic orchestration outside SR 26-2 scope, bank-approved basis); vendor due diligence VDD-231; exit analysis |
| 4 | Mandate and entitlements | PASS | Process owner; Security | Mandate M-AML-09: triage and evidence-gathering actions only; auto-closure restricted to validated low-risk classes; no filing authority; entitlement review ER-2026-56; revocation test 2026-09-02 |
| 5 | Fail-closed policy | PASS | Second-line risk | Policy version pol-aml-triage@14; outage transcript: policy-service failure produced require_approval on all 12 injected failures, pausing each action for a named reviewer; configuration review confirmed no fail-open setting |
| 6 | Human decision capacity | CONDITION | Approval-queue owner | Roster of 9 authorized reviewers; maker-checker enforced; capacity test passed at 1.4× forecast volume; condition: weekend coverage rota to be staffed by 2026-10-15 (owner: M. Laurent) |
| 7 | Negative-path tests | PASS | Technology owner; second line | RT-01–RT-09 transcripts on the production-mirror workflow, 2026-09-05; parameter-change-after-approval blocked; replay across runs refused; export verified offline |
| 8 | Monitoring and intervention | PASS | Process owner; risk owner | Threshold sheet MT-19; kill-switch test 2026-09-03; rollback criteria approved |
| 9 | Incident and resilience | PASS | Operational resilience owner | Fallback-to-manual exercise 2026-08-27; recovery objectives met; DORA incident-classification mapping v3 |
| 10 | Evidence and retention | PASS | Compliance; Internal Audit | Evidence contract EC-AML-02 in force; two sampled evidence bundles verified independently by Internal Audit on an offline machine; retention basis 10 years |

## Conditions

| Condition | Gate | Owner | Closure date | Accepted by |
|---|---|---|---|---|
| Weekend reviewer rota staffed and capacity-tested | 6 | M. Laurent | 2026-10-15 | CRO delegate (A. Weber) |

## Expiry and re-approval triggers

Approval expires **2027-09-14**. Early re-approval required on: model or provider version outside
the approved set; expanded mandate, tool, or data boundary; weakened policy or threshold; new
jurisdiction or customer segment; accepted monitoring breach; incident at severity 2 or above.

## Decision

**Approve with one condition.** Production authorization limited to the mandate in M-AML-09.
Approvers: Chair NFRC (D. Okafor), CRO delegate (A. Weber), Head of Compliance (S. Marchetti),
Head of Internal Audit (observer). Evidence pack: EP-2026-114. Minute: NFRC-2026-09-14-4.2.