Compliance Risks and Governance Priorities for Agentic AI

In a recent Navex article, Matt Kelly warns compliance professionals that while organizations are still grappling with generative AI, its more autonomous counterpart, agentic AI, is already introducing fresh challenges. 

Unlike traditional AI tools, agentic AI can act independently, create strategies, learn from experience, and collaborate with other AI agents to achieve goals. While these capabilities offer convenience and efficiency, they also carry significant compliance, ethical, and operational risks.

Examples abound. An AI agent managing supply chains might select suppliers with hidden labor or sanctions issues. Customer service bots could make unauthorized commitments, as occurred with a Canadian airline. In HR, AI agents screening candidates raise transparency and discrimination concerns. The compliance implications mirror those of other AI systems but with greater autonomy, requiring stricter oversight.

Kelly stresses that organizations can adapt existing AI governance practices to agentic AI, including centralized adoption policies, rigorous use-case risk assessments, and controls such as data validation, output monitoring, and employee training. However, the heightened independence of agentic AI necessitates expanded coordination across business units and tailored risk controls.

Practical hurdles include defining which tasks agentic AI may handle, determining acceptable vendors or platforms, and ensuring the explainability of agentic AI’s decision-making, critical for regulatory or reputational scrutiny. Kelly recommends treating AI agents much like third-party contractors, applying clear policies, training, and accountability mechanisms to the employees who deploy them.

For compliance teams, early governance is essential. By proactively defining permissible uses, vetting AI agents, and embedding ethical oversight, organizations can harness agentic AI’s benefits while mitigating its risks. Ultimately, Kelly notes, success still depends on human ethics guiding AI deployment.