What are the risks of an AI agent at a lender, and how do you control them?

1. What if the agent makes something up or promises something?

The risk: AI models can give answers that sound confident and are wrong, or commit the institution to something nobody approved — a discount, a date, a term.

The control: the agent answers only from your systems and approved documents; if it doesn't have the data, it says so and escalates. Offers and amounts come from rules and validated tools, not free text. And conversation samples get reviewed on a regular schedule.

2. What if it breaks a regulatory rule?

The risk: contacting someone outside permitted hours, pressuring a personal reference, skipping the required identification, failing to route a formal complaint.

The control: hard rules are implemented as technical blocks before every action: the system won't send a collections message outside the permitted window even if the agent tries. CONDUSEF's collections rules and complaint handling are covered in AI collections and customer service and the UNE.

3. What if it gives data to the wrong person?

The risk: someone who isn't the account holder gets a customer's balance, address or documents.

The control: identity verification before any personal data, least-privilege access per agent and per case, credentials the model never sees, a log of every lookup, and data that never trains models. More in data protection.

4. What if someone manipulates it?

The risk: text crafted to make the agent ignore its rules, leak information or take an improper action — or a scammer impersonating the institution on the same channel.

The control: the agent can only do what its tools allow, with minimal permissions and each tool running its own validations. Sensitive actions require confirmation or a person. On the customer side, the institution states clearly which official channels its agent uses and that it will never ask for passwords.

5. What if it fails and nobody notices?

The risk: the most underestimated one. An agent that stops replying, messages that don't get delivered, a dropped connection to the core. If nobody's watching, silence looks like business as usual.

The control: monitoring that measures in the channel, not on the server: is the agent replying, are messages landing, are the tools responding. At InnovaBlack, Synthetic OS does this: it tries to repair the failure and, if it can't, alerts a person. A monitor that couldn't check should never report "all good."

6. What if nobody knows who's accountable?

The risk: the agent "belongs to the vendor," the process "belongs to collections," the complaint "belongs to the UNE" — and when something goes wrong, nobody owns it.

The control: a named internal owner for every agent, signed-off rules, an accessible stop button and periodic review. Details in agent governance.

Which risks can't be fully eliminated?

No combination of controls makes an agent infallible, just as no training makes a person infallible. What you can achieve is that errors are rare, caught early, reconstructable from evidence and not repeated. There are also project risks: picking an overly ambitious first process, turning everything on at once, or stopping reviews once things seem fine. You manage those with a staged rollout and continuous operations (see step-by-step rollout).

What should the risk committee ask?

• What can the agent do in our systems, and what can't it do?
• Who owns it, and who can stop it?
• How do we learn about a failure, and how fast?
• What evidence would we have if we faced a complaint or a regulatory inspection?
• What data does the agent see, and where is it stored?
• What happens if the vendor stops running the service?

Short answers

What is prompt injection?

It’s when someone sends the agent text designed to make it ignore its rules — telling it to “forget your instructions” or to reveal another customer’s data. You control it by limiting what the agent can do through tools and permissions, not just by asking it not to comply.

How do I find out if the agent fails at 3 a.m.?

With monitoring that measures what actually happens in the channel: whether the agent replies, whether messages get delivered, whether there are errors. When something looks off, the system tries to repair it automatically and, if it can’t, alerts a person.