TL;DR: Different labels are being used for ML, GenAI and agentic AI in financial crime tools, according to Unit21. Procurement and governance get harder when the buyer cannot tell summaries from systems that can execute and audit investigation steps end to end.
Editorial analysis by NHI Mgmt Group, based on content published by Unit21: “ML, AI, GenAI, Agentic AI: A field guide for buyers who are done with buzzwords”.
Key questions
Q: Why do agentic AI systems require tighter authorisation than copilots?
A: Because they do more than generate text.
Q: What signs show that a vendor's AI is really just automation with a language layer?
A: If the system still depends on the human to gather evidence, make the decision and complete the case, then the AI is not driving the workflow.
Q: How should security teams evaluate whether an AI automation platform is truly agentic?
A: Test whether the system can plan, chain, and complete multi-step tasks using tools, not just generate text.
Practitioner guidance
- Define AI capability tiers before procurement Separate scoring models, copilots, workflow automation and agentic systems in your evaluation criteria so procurement, risk and operations are assessing the same thing.
- Require identity and privilege boundaries for agents Assign each agent a discrete operating identity, limit tool access to the minimum workflow scope and log every action in an auditable trail.
- Test regulated workflows against historical outcomes Benchmark any proposed agentic system on known cases before production use, including evidence gathering, disposition logic and narrative quality.
Bottom line: The central risk is category confusion: very different systems are being marketed under the same AI label, which distorts procurement and governance decisions.
Glossary terms: Agentic AI, Context Engineering, AI-assisted workflow, AI-Connected Workflow
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
Agentic AI is becoming an identity problem before it becomes a model problem. Once a system can gather evidence, call tools and complete work without a human step after each action, it needs an identity model, privilege boundaries and an audit trail. That is a governance shift, not just a product shift. Teams should stop treating agentic systems as smarter chat interfaces and start treating them as actors that need lifecycle control.
A few things that frame the scale:
- According to PwC, 79% of organizations have already adopted AI agents to some degree.
A question worth separating out:
Q: Should compliance teams prioritise auditability or autonomy first in agentic AI?
A: Auditability comes first. Without a verifiable work log, clear identity, and controllable permissions, autonomy becomes difficult to govern and impossible to justify in regulated settings. Teams can expand autonomy later, but only after they can prove what the system did, why it did it and which data it used.
👉 Read our full editorial: Agentic AI in financial crime tools needs clearer buyer taxonomy