Topic starter
06/06/2026 11:10 am
TL;DR: Organisations deploying agentic AI are finding that ISO 42001, NIST AI RMF, and the EU AI Act do not yet map cleanly to agent behaviour, while UK and EU supervisory bodies are starting to focus on accountability, logging, autonomy limits, and provider-deployer responsibility, according to Zenity. The practical problem is that current governance assumes stable, reviewable actions, but agents can act within bounded autonomy in ways that outpace human oversight cycles.
Editorial analysis by NHI Mgmt Group, based on content published by Zenity: “Build for Tomorrow, Today: Deploying Agentic AI Under EU and UK Regulations”.
Key questions
Q: How should security teams govern agentic AI as it moves into production?
A: Security teams should govern agentic AI as a class of non-human identity, not as a generic application feature.
Q: Why do existing AI governance frameworks struggle with agentic systems?
A: They mostly describe models, risk categories, or high-level oversight, while agentic systems also need identity, permissions, tool access, and execution controls.
Q: What breaks when human-in-the-loop control is the only safeguard for agents?
A: Human-in-the-loop control breaks down when approval happens after the agent has already inspected sensitive data, prepared side effects, or chained multiple tool calls.
Practitioner guidance
- Treat each agent as a governed digital actor Assign a first-class identity, a named owner, a defined purpose, an approved toolset, and a bounded system reach before allowing production use.
- Build evidence-grade logging Record what the agent could do, what it actually did, and which actions were gated, so incident review and regulatory challenge are both supportable.
- Constrain autonomous actions with hard boundaries Reserve human approval for irreversible, regulated, or externally binding actions such as payments, deletions, and public communications.
Bottom line: Agentic AI regulation is already relevant in the EU and UK, but existing frameworks still leave a practical gap between policy language and runtime agent behaviour.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 11:49 am
Regulation has already reached agentic AI, but the control model has not caught up. The EU AI Act, GDPR, NIS2, and DORA already impose duties that touch agent behaviour, yet most governance programmes still treat agents as if they were ordinary software workflows. That mismatch leaves teams trying to apply static oversight to systems that can plan and act within a session. The implication is that agent governance has to be designed as a runtime control problem, not a policy overlay.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should organisations document when deploying vendor-hosted agentic AI?
A: They should document who controls instructions, logs, memory disablement, deletion support, incident investigation, and the evidence returned to the customer. Those ownership questions determine whether the organisation can prove accountability, satisfy privacy obligations, and explain incidents when the runtime is partly provider-managed.
👉 Read our full editorial: Agentic AI regulation in the EU and UK exposes governance gaps