Topic starter
11/07/2026 8:48 pm
TL;DR: Third-party risk teams are increasingly using AI to accelerate vendor onboarding, monitoring, and control assurance, but most organisations are adopting agentish rather than fully agentic systems because oversight, guardrails, and accountability still matter, according to OneTrust. The practical issue is not whether AI can act, but where human review must remain in the loop.
Editorial analysis by NHI Mgmt Group, based on content published by OneTrust: “Agentic Vs. Agentish AI: What It Means for Third-party Risk Management”.
Key questions
Q: What is the practical difference between agentic AI and agentish AI in third-party risk?
A: Agentish AI works within defined guardrails and supports humans with tasks such as evidence review, scoring, and reminders.
Q: Why does AI automation in vendor oversight still need human approval?
A: Because the control objective is defensibility, not just throughput.
Q: What are the warning signs that AI SOC automation is becoming unsafe?
A: Look for actions taken without a linked case, approvals that happen after execution, investigation summaries that cannot be traced back to source evidence, and workflow changes that only one team member understands.
Practitioner guidance
- Define the AI operating boundary for third-party risk Specify which steps AI may complete autonomously, which require review, and which remain human-only across onboarding, monitoring, and control assurance.
- Map AI permissions to a lifecycle owner Assign an accountable owner for data access, tool access, approval rights, and offboarding before an agent can touch vendor evidence or risk records.
- Instrument decision logging and evidence traceability Capture inputs, outputs, exceptions, and reviewer actions so that every AI-assisted recommendation can be reconstructed during audit or incident review.
Bottom line: Agentish AI is the better fit for third-party risk today because it supports bounded automation without surrendering human accountability.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:13 pm
Agentish AI is the safer default for third-party risk today. The article shows that most risk teams are not yet ready to delegate end-to-end judgement to autonomous systems, because vendor oversight still depends on explainable decisions and accountable review. Agentish AI fits the programme model that most organisations already operate: bounded automation with human approval at the points that matter. Practitioners should see this as a governance design choice, not a temporary compromise.
A few things that frame the scale:
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Who is accountable when a third party introduces compliance or AI governance risk?
A: The organisation that engaged the third party remains accountable for many of the resulting obligations, even when the vendor performed the activity. That is why contracts, oversight, and evidence collection must be built into vendor governance from the start, not added after an incident.
👉 Read our full editorial: Agentic vs agentish AI: what risk teams need to know