Who Signs Off on the Agent?

The current fascination with AI agents is reaching a fever pitch. We've moved past simple chatbots that suggest rhymes for 'orange' and into the era of the agent—software that doesn't just suggest an action but executes it. In the niche world of club management, we see this already; Golfmanager has integrated native MCP capabilities with ChatGPT and Claude, effectively allowing golf clubs to run operations via AI assistants.

It sounds efficient. It looks lean on a slide deck. From a regulatory perspective, it's a mess.

The problem isn't the technology, but the gap between the rules we have and the way these tools are being deployed. Most firms treating this as a standard vendor procurement exercise are making a mistake. They check for a SOC 2 report or a nod toward ISO 42001, see that the vendor is 'compliant', and tick the box. But ISO 42001—the AI management system standard—is fundamentally about the *process* of managing AI risk. It doesn't magically remove the risk of an autonomous agent deciding to move sensitive data into a public-facing bucket because it thought that was the most 'efficient' way to complete a task.

The fallout from the Hugging Face breach has already caught the attention of policymakers. Congressman Mike Lawler is introducing a bill specifically to crack down on these AI agents. This isn't an isolated political gesture; it's a reaction to the reality that when an agent acts, the traditional audit trail breaks.

If a human employee leaks data, you have a user ID and a disciplinary process. If an autonomous agent leaks data because of a prompt injection or a logic error in its 'agentic' loop, who is the accountable party?

The objection usually raised by the optimists is that the EU AI Act already handles this via high-risk classifications and transparency requirements. They argue that as long as the system is labelled as AI, the requirement is met.

This is a misunderstanding of how enforcement works. A transparency label doesn't stop a data breach. The French hospital fined €500,000 last week for exposing the records of 727,000 people didn't fail because they lacked a label; they failed because their security controls were inadequate for the volume and sensitivity of the data they held. When you introduce an AI agent into that mix—one capable of altering permissions or accessing databases autonomously—you aren't just adding a tool. You are adding a new, unpredictable user with administrative privileges.

The downstream effect here will hit professional indemnity insurers first. Underwriters generally dislike ambiguity. If a firm cannot produce a human-in-the-loop log for every critical action taken by an agent, insurers will likely stop covering AI-driven losses or hike premiums to a point that makes the 'efficiency' of the agent moot. We can expect this to happen long before the regulators find their footing.

So, who actually has to do something?

If you've integrated any agentic AI into your operational workflow this year, your risk register is likely lying to you. You need to stop looking at the vendor's certificate and start looking at the agent's permissions. Specifically, the CISO needs to document exactly what the agent can *do*—not just what it can *see*. If an AI assistant can trigger a payment, change a user privilege, or export a CSV of customer emails, that action needs a manual override and a hard stop.

It's a tedious bit of paperwork. It involves mapping every single 'action' the agent is capable of performing back to a human owner who accepts the risk.

Most firms won't do it because it kills the speed that makes AI agents attractive. They’ll prefer to rely on the vendor's claim that the system is 'safe by design'. But as any civil servant will tell you, 'safe by design' is usually shorthand for 'we haven't thought about how this fails yet'.

I suspect we'll see a surge in findings during next year's audits regarding 'unauthorised autonomous access'. The auditors will point to the lack of oversight, and the firms will point to their ISO certificates.

The certificate won't stop the fine.