SM&CR Responsibilities Map For AI Workflows: Owners, Approvers And Evidence In Code

An SM&CR responsibilities map for AI workflows answers two questions a supervisor or auditor will ask: who is accountable for this agent, and who was allowed to approve what it produced? The 22 October 2026 proposals make the answer more important to hold in your own systems, because fewer people would appear on the regulator's register. This is engineering guidance for keeping that record, not regulatory advice.

What did the PRA and FCA propose on 22 October?

The PRA and FCA announced parallel consultations on 22 October 2026 to simplify the Senior Managers and Certification Regime. The proposals would remove the Certification Regime and its admin for around 139,000 individuals below senior manager level, move some roles such as Chairs of Risk and Audit Committees from pre-approval to notification, and raise the conduct rule breach reporting threshold for most staff below senior manager level.

CEOs, CFOs and Chairs would still need regulator pre-approval. The regulators expect the changes to save firms around £2 billion over ten years. The consultations close on 22 January, policy is expected in 2027, and some changes need legislation.

What should an SM&CR responsibilities map for AI hold?

• **Each agent and its workflow.** One identity per agent, never a shared service account.
• **The owning senior manager function.** For example SMF24 (Chief Operations) for an operations reconciliation.
• **Named approvers.** The people allowed to approve that workflow's output.
• **Evidence.** Each approval with who, when and what, kept with the map version in force at the time.

How do you check the map in code?

"""An SM&CR responsibilities map for AI-assisted workflows, checked in code.

The PRA and FCA proposals of 22 October 2026 keep senior manager accountability and would remove the
Certification Regime for around 139,000 individuals. Fewer people on the register means your own map of
who owns each workflow, and who may approve its output, matters more. Python 3.14 standard library only.
"""
from __future__ import annotations

SENIOR_MANAGERS = {"SMF24": "Chief Operations", "SMF16": "Compliance Oversight", "SMF3": "Executive Director"}
AGENTS = {
    "recs-01": {"workflow": "Daily mismatch report", "owner": "SMF24", "approvers": {"ops.lead"}},
    "kyc-02": {"workflow": "Client onboarding files", "owner": "SMF24", "approvers": {"onboarding.lead"}},
    "reg-03": {"workflow": "Regulatory digest", "owner": "", "approvers": {"compliance.officer"}},
}
STAFF = {"ops.lead": "SMF24", "onboarding.lead": "SMF24", "compliance.officer": "SMF16", "analyst.7": "SMF24"}
APPROVALS = [("recs-01", "ops.lead"), ("kyc-02", "analyst.7"), ("reg-03", "compliance.officer")]


def check() -> list[str]:
    issues = []
    for agent, a in AGENTS.items():
        if a["owner"] not in SENIOR_MANAGERS:
            issues.append(f"{agent} ({a['workflow']}): no senior manager owns this workflow")
    for agent, person in APPROVALS:
        a = AGENTS[agent]
        if person not in a["approvers"]:
            issues.append(f"{agent}: {person} approved but is not a named approver for {a['workflow']}")
        elif STAFF.get(person) != a["owner"] and a["owner"]:
            issues.append(f"{agent}: approver {person} reports outside the owning function")
    return issues


if __name__ == "__main__":
    for owner, name in SENIOR_MANAGERS.items():
        owned = [a["workflow"] for a in AGENTS.values() if a["owner"] == owner]
        print(f"{owner} {name:<22} {owned}")
    print("issues:")
    for i in check():
        print("  -", i)

The sample maps two operations workflows to SMF24 and leaves the regulatory digest without an owner. The check reports that gap and an onboarding approval by an analyst who is not a named approver. Run it daily against the approvals log and send findings to the owning senior manager.

What breaks in production?

• **Maps kept in a document.** If the map is not data, nothing checks it. Keep it in version control and test it.
• **People who move roles.** Approver lists drift when people change jobs. Tie them to your HR or identity system.
• **Vendor agents.** Agents inside bought software still need an owner on the map.
• **Approvals without evidence.** An approval record needs the payload and the time, not only a name.

What are the alternatives to a map in code?

Our playbook on agent registers and decision records provides the agent identities, and AI incident reporting covers near misses. Our blog explains SM&CR reform for business readers.

Where should a firm start?

List every agent and the senior manager whose responsibilities cover it, then compare a month of approvals against the named approvers. The sign-off trail is one of the premium features of our Desk Twin, and our AI Agency London team can set the map up in a 14-day Proof Run alongside one workflow from our services page.