Start by checking which law, supervisory expectation, proposal, or guidance applies to your organization. The table identifies each instrument, its status, and who it addresses. The contribution section then explains what AAES Govern records can help a reviewer examine.
These pages describe the product and cite public instruments. They are not legal advice, not a certification, and not a statement that any instrument applies to your organization. The official source is authoritative; applicability questions belong to your advisers.
Instruments, by status
| Instrument | Status | What it addresses |
|---|---|---|
| PS21/3 · FCA and SS1/21 · PRA: operational resilience | Binding rules introduced by PS21/3 sit in the FCA Handbook; SS1/21 is a PRA supervisory statement setting expectations. In force from 31 March 2022; the mapping-and-testing transition completed 31 March 2025. | Important business services, impact tolerances, mapping of dependencies (including technology and third parties an AI agent relies on) and scenario testing. An agent action path that supports an important business service sits inside this mapping. |
| Critical Third Parties regime · FCA / PRA / Bank of England | Regime in force 1 January 2025. The first Treasury designation regulations took effect on 13 July 2026; direct oversight applies to designated providers and systemic services. | HM Treasury may designate a third party as critical to the financial sector, bringing it under direct regulator oversight; a vendor's services being systemic does not by itself trigger designation. |
| FCA PS26/2 · PRA PS7/26 · Bank of England FMI policy statement | Final policy published 18 March 2026; rules apply from 18 March 2027. Finalized guidance FG26/3 and FG26/4 (FCA) and SS1/26 with an SS2/21 update (PRA) accompany the policy statements. | Standardized incident reporting and registers of material third-party arrangements: the reporting surface an agent-related incident would travel through. |
| Senior Managers & Certification Regime (SM&CR) and Consumer Duty · FCA | Binding accountability regime. | Relevant senior managers remain accountable within their allocated areas of responsibility, and applicable prescribed responsibilities may also bear on AI governance; the Consumer Duty applies principally to retail-market business. Using AAES does not transfer that accountability, and an AAES accountable-manager registration is not an SM&CR appointment. |
| UK GDPR, as amended by the Data (Use and Access) Act 2025, section 80 | Binding law. Section 80 of the 2025 Act replaced Article 22 with new Articles 22A–22D, in force 5 February 2026 (SI 2026/82): a permission-with-safeguards model for solely automated significant decisions, with tighter rules for special-category data. The commencement instrument also brings further data-protection provisions into force on 19 June 2026. | Solely automated decisions with legal or similarly significant effect: transparency, representations, human intervention and contestation safeguards under Article 22C. |
What AAES Govern records may contribute
| Expectation | AAES contribution | Capability status |
|---|---|---|
| Named senior accountability (SM&CR) | Each registered agent has an accountable manager whose chain of managers ends at a person. AAES Govern records the approver for human approval decisions; those assignments do not establish statutory appointments. | Implemented. |
| Human intervention in consequential actions (UK GDPR automated-decision safeguards; Consumer Duty outcomes) | Capabilities registered as irreversible require human approval bound to the exact request, with expiry. The operator classifies the action and must ensure reviewers have the information and authority to decide. | Implemented. |
| Evidence for resilience mapping, self-assessment and incident review (PS21/3 / SS1/21; reporting policy) | Decision records are linked by cryptographic fingerprints to help detect changes. The client's own reviewer can check an export offline. | Implemented. An independently controlled witness can be configured separately; that is not an external assessment, and the default deployment has none. |
AAES Govern decision records may support review of access and approval controls. They do not establish lawful processing, model fairness, suitability, or compliance with any instrument as a whole.
Export checks do not establish complete capture, downstream success, or meaningful human oversight. Enforcement requires a credential path the agent cannot bypass. See the verification checks and their limits.
Your responsibilities
- The client remains the regulated entity. Ask your advisers which regime applies (FCA, PRA, ICO, or none).
- Activity outside AAES Govern is visible only where telemetry is supplied. Decision records cover routed requests; reported telemetry may describe other activity without establishing complete coverage.
- AAES has no independent certification or assessment. No SOC 2 report exists, and no penetration test has been performed yet; an independent test is planned for Q4 2026.
- Status changes. The reporting rules apply from 18 March 2027. Re-check the primary source before relying on the status shown here.
Bring the instruments your risk team cites to a scoped evaluation.