Agentic AI · Risk & Compliance

Agents move faster
than the cycle around them.

Models are validated regularly, agents are constantly active, and governance committees convene monthly, with agents making thousands of small decisions daily. This misalignment is the primary compliance issue in 2026, and adopting a 'wait and see' approach is now the riskiest strategy on the board's list.

See NIST AI RMF mapped to agents → Check the insurance signal
overview SLIDE 01 : AGENT COMPLIANCE & RISK Cover slide: Agent Compliance and Risk
Quick answer

Agent compliance and risk management field of managing risk associated with autonomous AI agents, which regulators, auditors, and insurers now distinguish from traditional AI risk due to agents' ability to not only generate content, but also carry out actions such as coding, making API calls, modifying databases, processing payments, and communicating with external sources. The focal point of compliance efforts in 2026 is the. NIST AI Risk Management Framework (Govern, Map, Measure, Manage) is becoming the go-to operational framework, regardless of jurisdiction, aligned with mandatory regulations such as the. EU AI Act and risk-proportional frameworks like Singapore's Model AI Governance Framework for Agentic AI. The clearest 2026 signal isn't regulatory : it's that insurance carriers have begun excluding AI liability Due to corporate policies, quantified, monetary risk reporting to the board has become a practical necessity, not just a luxury.

risk matrix
structural risk SLIDE 02 : THE STRUCTURAL MISMATCH The structural mismatch between agent decision speed and traditional governance cycles
Why old controls don't fit new behavior

Static controls, adaptive systems

The conventional approach to AI governance involved a model validated periodically, overseen by a governance committee meeting monthly or quarterly, and operating within a rarely revised risk appetite statement. However, an agent disrupts these assumptions by operating continuously, making numerous decisions daily, and adapting behavior beyond the scope of a static risk statement.

An agent outpacing the compliance cycle exerts significant pressure to speed up the cycle, but rushing professional and regulatory judgment may increase the error risk the cycle aims to detect.

risk matrix
inflection point SLIDE 03 : WHY "WAIT AND SEE" STOPPED WORKING Why 2026 made wait-and-see the highest-risk compliance strategy
Several shifts, arriving at once

Each one of these is essential. Together, they are indispensable.

Big insurance companies have begun excluding AI liability from their corporate policies. Financial regulators have released guidance specifically for AI and are training staff to audit it. OWASP released a Top 10 list for AI applications. Legal documents have surfaced arguing that high-risk AI systems with untraceable drift should not be allowed on the EU market.

The combined changes rendered the AI compliance programs of 2024 outdated. Ignoring agent compliance as a current issue poses the greatest risk for any board.

risk matrix
The operational backbone

Govern, Map, Measure, Manage : for agents specifically

The private sector is not required to follow NIST's AI RMF, but it has become the standard language used by regulators, auditors, and cyber-insurance underwriters, making it practically mandatory in practice.

framework SLIDE 04 : THE NIST AI RMF, MAPPED TO AGENTS NIST AI RMF's four functions mapped to specific agent controls
Four abstract functions, made concrete

Each function has a specific agent-shaped job

The four functions align with agent-specific controls, transforming a broad risk framework into a practical implementation for engineering and compliance teams.

Govern
Assign accountability

Policy owners must explicitly name human accountability, approval rules, and exception handling, rather than implying them.

Map
Inventory the estate

Each agent, tool, dataset, MCP server, API, user, scope, and high-risk action meticulously documented.

Measure
Track outcomes

Denials, approvals, misuse of tools, issuance of credentials, and policy results occur persistently.

Manage
Act on findings

Prevent risky behaviors, limit access, terminate sessions, enforce policies, maintain evidence.

risk matrix
regulatory map SLIDE 05 : MULTIPLE FRAMEWORKS, CONVERGING EXPECTATIONS EU AI Act, Singapore MAS/IMDA, ISO 42001, and AIUC-1 compliance frameworks compared
Different laws, the same shortlist of expectations

Risk-based governance, board accountability, human oversight : everywhere

The EU AI Act enforces mandatory risk-tiered regulations, with penalties reaching seven percent of global annual revenue for prohibited activities. Singapore's Model AI Governance Framework for Agentic AI, developed by the Infocomm Media Development Authority, focuses on four key aspects: managing risks proactively, ensuring human accountability, implementing technical controls, and promoting end-user responsibility. ISO/IEC 42001 outlines formal requirements for AI management systems, while industry-specific frameworks such as AIUC-1 are being developed to address identity, access, and accountability challenges posed by AI agents.

Regulators from different jurisdictions are aligning on a common shortlist, allowing a single control to satisfy multiple frameworks instead of needing separate compliance programs for each regulator.

risk matrix
classification SLIDE 06 : CLASSIFY BEFORE THE LAW CATCHES UP Risk classification for agent use cases even ahead of formal legal classification
Don't rely on a court to inform you of the risk level.

Certain domains earn scrutiny before the paperwork does

Security and compliance teams should be prepared for high-risk evidence requirements for agents involved in hiring, credit, regulated reporting, public services, or critical infrastructure, even before a formal legal classification is determined for that specific use case. Relying on definitive legal guidance before establishing the necessary evidence trail for these domains is a risky decision.

One effective strategy is to limit risk early on by focusing on specific use cases, considering the deployment context along with the model itself, and creating an audit trail assuming the worst-case scenario.

risk matrix
From qualitative to quantified

"High risk" isn't a number a board can act on

The insurance signal is more precise than the regulatory signal, making quantifying risk in monetary terms essential.

board reporting SLIDE 07 : QUANTIFYING RISK IN MONETARY TERMS Quantifying AI agent risk in expected annualized monetary terms for board reporting
A number the finance team can work with

Expected annualized loss, not a red-yellow-green sticker

Boards now require a specific number: anticipated yearly loss in euros or dollars, rather than a vague 'high' or 'medium' classification that can be interpreted differently by each individual. This numerical value aligns AI risk with the language already used by risk, compliance, technology, and insurance teams for their management practices.

risk matrix
market signal SLIDE 08 : THE INSURANCE SIGNAL Insurance market shifts on AI liability coverage as a compliance signal
The market is pricing this faster than the law is

Carriers are voting with exclusions

Underfunded governance programs in 2024 are now receiving funding due to the insurance signal being more pronounced than the regulatory one. Leading carriers are now excluding AI liability from corporate policies, indicating a trend towards more exclusions or stricter control requirements before coverage is granted.

A board in a secure position is able to address three crucial questions: the current status of AI liability insurance coverage, the future market trends, and the necessary controls to enhance coverage. Failure to answer these questions will leave the board vulnerable at renewal time, the most inconvenient moment to realize the gap.

risk matrix
execution controls SLIDE 09 : EXECUTION GOVERNANCE FOR AGENTIC ACTIONS Mandatory human approval thresholds for high-risk agentic execution
Agents act : that's the whole compliance problem

Data protection alone won't cover this

Conventional AI risk strategies focus on safeguarding data access, while Agentic AI requires additional oversight to manage code execution, API calls, database modifications, email transmissions, and transaction processing. Without proper controls, an agent can serve as an automated privilege-escalation tool, posing a broader risk than just data access.

Regardless of the agent's confidence level, specific actions such as financial transactions exceeding a set limit, modifications to access controls, data removal, and external communications made on behalf of the organization should always necessitate human approval.

board summary SLIDE 10 : WHAT TO TELL THE BOARD Summary: three things every board needs to hear about AI agent compliance
Three sentences, honestly answered

The estate, the gaps, and the coverage

A board must have three key pieces of information: the size and classification of the AI estate along with quantified risk in expected annualized monetary terms, the current status of governance infrastructure compared to relevant frameworks, including identified gaps and treatment plans, and the current state of insurance coverage for AI liability as well as market trends.

This is not a one-off task, but rather a continuous cycle of growth. Regularly conduct red-team exercises, reassess risks every quarter as use cases develop, and monitor maturity in strategy, risk management, data and technology, governance, and agentic AI governance. Organizations that view this as a future issue in 2026 will be prepared for the challenges of 2027. Those still treating it as a 2024 problem will find themselves scrambling to catch up when their insurance renewal is due and when asked for evidence they are unable to provide.

Frequently asked

Agent compliance & risk FAQ

Agents continuously act and adapt, contrasting with traditional governance that relies on periodic model validation and infrequent risk-appetite revision. A governance committee meeting quarterly cannot effectively keep up with a system that makes thousands of small decisions daily : the misalignment between governance frequency and agent decision speed is the fundamental issue.

The four functions of this system correspond to specific agent controls: Governing assigns policy owners and approval rules; Mapping inventories all agents, tools, MCP servers, APIs, and high-risk actions; Measuring continuously tracks denials, approvals, and abnormal tool usage; Managing blocks unsafe actions, restricts credentials, and preserves evidence. While voluntary for private companies, it serves as the default standard referenced by auditors and insurers.

Major carriers have started excluding AI liability from corporate policies, sending a swift and clear market signal that outpaces regulatory enforcement. A board that cannot articulate its AI liability coverage and understand market trends is vulnerable in a way that regulation cannot fully address.

This involves overseeing the actions an agent can perform, such as running code, accessing APIs, modifying databases, sending messages, and transferring funds, rather than just determining the data it can retrieve. Certain tasks, like high-value financial transactions, altering access controls, deleting data, and communicating externally, should only be carried out with human authorization, regardless of the agent's level of certainty.

Teams should anticipate and prepare for high-risk evidence requirements for agents involved in hiring, credit, regulated reporting, public services, or critical infrastructure, even before a formal legal classification is established for that particular use case. Delaying until there is legal certainty will result in starting the evidence trail too late.

The AI estate's size and risk classification, along with the quantified expected annualized loss; the progress of governance infrastructure completion against relevant frameworks, including identified gaps and treatment plans; and the current status and future trajectory of insurance coverage for AI liability.

Get started

Ready to quantify and govern your agent risk?

Assess your AI infrastructure using the NIST AI RMF's four functions, calculate risks in monetary terms for your finance team, and review insurance coverage prior to your next renewal, not after.

Revisit the NIST AI RMF mapping → Back to quantifying risk