Agentic AI Governance

Regulatory approaches: the mechanisms behind the coverage

No instrument in the coverage matrix regulates "agentic AI" as a named category; instead, agentic behaviour is reached indirectly through obligations attached to autonomy, tool use, and downstream action. The EU AI Act's primary mechanism is a design-and-operation duty: high-risk systems must be built so that natural persons can monitor them and "intervene…or interrupt the system through a 'stop' button," with measures "commensurate with the risks, level of autonomy and context of use" (EU AI Act Art. 14(3)–(4)). Whether such human oversight can deliver its intended protective effect over autonomous systems is itself contested ¹. For general-purpose models, the EU AI Office's 2025 GPAI Guidelines treat a model's autonomy and agentic use as factors bearing on a systemic-risk designation, which triggers risk-management and adversarial-testing duties (EU AI Office, GPAI Guidelines and Code of Practice, August 2025) (Regulation (EU) 2024/1689, Art. 51(1)(b), Annex XIII(e)). Other instruments work through softer modalities. The G7 Hiroshima Process International Code of Conduct (adopted 30 October 2023) sets eleven voluntary actions — risk identification across the lifecycle, red-teaming, incident reporting — now monitored via an OECD reporting framework (OECD, February 2025). The Seoul Frontier AI Safety Commitments (May 2024) bind sixteen firms to define "intolerable risk" thresholds, including for model autonomy and evasion of human oversight, and to pause deployment if mitigations fail. NIST's contribution is procedural taxonomy rather than rule: NIST AI 100-2 (March 2025 update) names AI agents as an adversarial-ML threat surface (prompt injection, memory poisoning, tool-supply-chain attacks) (NIST AI 100-2e2025). Frontier developers' own scaling policies make autonomy an explicit governed threshold: OpenAI's Preparedness Framework (2023) named Model Autonomy as one of four tracked risk categories, Google DeepMind's Frontier Safety Framework counts Autonomy among its four Critical Capability Level domains, and Anthropic's Responsible Scaling Policy ties ASL thresholds to autonomous-replication and agentic-capability evaluations. Beyond its adversarial-ML taxonomy, NIST's Generative AI Profile (NIST AI 600-1) reaches agentic deployments through a Value Chain and Component Integration risk category covering tool-use and integrated components.

Key fault lines: where the governance debate genuinely diverges

The deepest contested question is the liability gap. Because AI agents lack legal personhood and are treated as property, it is unsettled who bears responsibility when an agent acts harmfully or binds a principal — developer, deployer, or no one. Gabison and Xian (2025) model this through principal-agent theory, finding that information asymmetry and attribution failures mean LLM agents cannot satisfy the criteria of an ordinary (human) agent — an agency gap in principal-agent terms ². A parallel strand applies agency law and theory directly to characterise these problems and to propose governance infrastructure built on inclusivity, visibility, and liability ³. Multi-agent delegation sharpens the problem: liability frameworks built for single agents do not allocate fault when one agent subcontracts to others built by different firms (Berkeley Technology Law Journal, 2026), and multi-agent systems introduce failure modes — miscoordination, conflict, and collusion — distinct from single-agent AI ⁴. A competing line argues existing instruments suffice — the Uniform Electronic Transactions Act's "electronic agent" rule already attributes machine-formed contracts to the deploying human, sidestepping personhood. A second fault line is whether "human oversight" is even workable at agentic speed and scale. Critics warn that overseers given tasks they cannot realistically perform become "liability sponges," absorbing blame without genuine agency — a rule-of-law concern (Fink, 2025, on Art. 14). A third divergence is definitional and jurisdictional: the EU declines to make agents a distinct category, folding them into existing AI-system and GPAI duties, while NIST and AI Safety Institutes pursue agent-specific evaluation standards — reflecting unresolved disagreement over whether agentic action is a new regulatory object or an old one in new clothing.

Trajectory: recent and pending developments

Agentic governance is moving from declaratory commitments toward operational testing and standard-setting, but remains overwhelmingly voluntary. The institutional centre of gravity in 2025–26 has been the AI Safety/Security Institutes. The UK AI Security Institute published its first Frontier AI Trends Report (December 2025, covering >30 systems), documenting that agents complete hour-long software tasks more than 40% of the time, and released an Autonomous Systems Evaluation Standard plus the open-source Inspect harness for agentic evaluations ⁵. Such evaluation regimes are increasingly grounded in standardized harm benchmarks measuring whether agents resist or comply with harmful multi-step tool-use tasks ⁶. A multilateral joint testing exercise on agentic safety — splitting sensitive-information leakage and fraud (Singapore) from cybersecurity (UK) — signals coordination on shared evaluation methods rather than shared binding rules. On the standards track, NIST's Center for AI Standards and Innovation launched an AI Agent Standards Initiative on 17 February 2026, pointing toward least-privilege, task-scoped permissions, and action-level approvals for high-impact agent decisions; complementary research proposes authenticated, authorized, and auditable delegation by extending OAuth 2.0/OpenID Connect to maintain accountability chains for agent actions ⁷. Proposals for agent identifiers and activity logs further aim to give governance actors visibility into where, why, how, and by whom agents are used ⁸. Binding obligations advanced chiefly via the EU: GPAI provider duties took effect 2 August 2025, with the systemic-risk pathway capturing agentic capability (Regulation (EU) 2024/1689). By contrast, several US legislative vehicles in the matrix stalled — a state Frontier AI Models Act was vetoed and remains silent on agentic action — underscoring that, as of mid-2026, the binding edge of agentic governance sits in the EU while most other instruments operate through disclosure, evaluation, and voluntary thresholds (composite Policy Window assessment of the cited instruments).

Historical primacy & cross-jurisdiction tension

First addressed by NIST AI Risk Management Framework on 2023-01-26 (implicit). Subsequent regimes have either codified, diverged from, or remained silent on this baseline.

• Forum-shoppingSeoul Declaration on Safe, Innovative and Inclusive AI↔Executive Order 14110 on Safe, Secure, Trustworthy AI
• Forum-shoppingNIST AI RMF Generative AI Profile↔Executive Order 14179 — Removing Barriers to American Leadership in AI
• Forum-shoppingAnthropic Responsible Scaling Policy (RSP) v2↔UK Pro-Innovation Approach to AI Regulation (White Paper)

Silent regimes — gap signal

Instruments that do not address Agentic AI Governance — candidates for future policy work.

• Executive Order 14110 on Safe, Secure, Trustworthy AIUS
• Executive Order 14179 — Removing Barriers to American Leadership in AIUS
• UK Pro-Innovation Approach to AI Regulation (White Paper)UK
• OECD AI Principles (Recommendation)OECD
• UN GA Resolution on Safe, Secure, Trustworthy AIUN
• California SB-1047: Safe and Secure Innovation for Frontier AI Models ActUS
• India Digital Personal Data Protection Act + AI Advisory (MEITY)IN
• ASEAN Guide on AI Governance and EthicsASEAN
• African Union Continental AI StrategyAfrican_Union
• White House Voluntary AI CommitmentsUS
• Singapore Model AI Governance Framework for Generative AISG
• Japan METI AI Guidelines for BusinessJP
• General Data Protection Regulation (GDPR)EU
• EU General-Purpose AI Code of PracticeEU
• OMB Memorandum M-24-10 (Advancing Governance, Innovation, and Risk Management for Agency Use of AI)US
• GSA Generative AI and Specialized Computing Infrastructure Acquisition Resource GuideUS
• DoD Responsible AI Strategy and Implementation PathwayUS
• FedRAMP AI Cloud Procurement GuidanceUS
• DFARS Subpart 252.204 (Safeguarding Covered Defense Information and Cyber Incident Reporting)US
• California SB 243: Companion ChatbotsUS
• California SB 942: AI Transparency ActUS
• UNESCO Recommendation on the Ethics of Artificial IntelligenceUNESCO
• Provisions on the Administration of Deep Synthesis of Internet Information ServicesCN
• TAKE IT DOWN Act (Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act)US
• Italy Law No. 132/2025 on Artificial Intelligence (Legge 23 settembre 2025, n. 132)IT
• Japan AI Promotion Act (Act on the Promotion of Research, Development and Utilization of AI-Related Technologies)JP
• UN Global Digital CompactUN

Does governance work? — the social-science evidence

What the peer-reviewed social science shows: whether the harm this topic addresses is empirically real, and whether governance of it works. The badge is the epistemic status of the evidence(not the policy debate) — “thin” or “absent” efficacy evidence is itself a finding (the “second silence”). Each epistemic-status label is Policy Window's editorial assessment of the cited evidence base (a structured classification), not a verdict any single source issues.

• Is the harm real?evidence: thin

  The capability that agentic governance targets — autonomous multi-step action — is real and rapidly, measurably advancing: METR finds the task length AI agents complete at 50% reliability has doubled roughly every seven months for the past six years (about 50 minutes for frontier 2025 models), and the UK AI Security Institute's first Frontier AI Trends Report (Dec 2025, >30 systems) reports models now finish hour-long software tasks >40% of the time versus <5% in late 2023. The distinct realized HARM from agency (as opposed to the underlying model) is, however, thinly documented: on consequential real-world tasks agents still fail the majority — Gemini 2.5 Pro completed only 30.3% of TheAgentCompany's 175 professional tasks (OpenHands scaffold, project leaderboard) — so the agency-specific harm magnitude is early and context-dependent rather than established at scale.

  Sources: Kwa, West, Becker et al. 2025 (METR; arXiv:2503.14499, 'Measuring AI Ability to Complete Long Tasks'); UK AI Security Institute 2025 (Frontier AI Trends Report, Dec 2025); Xu, Song, Zhou et al. 2024 (TheAgentCompany, arXiv:2412.14161); 30.3% figure per TheAgentCompany leaderboard (OpenHands)

• Does governance work?evidence: absent

  There is no impact-evaluation evidence that agent-specific governance reduces agentic harm: the operative regimes — the EU GPAI Code of Practice (published July 2025, voluntary/non-binding), the Seoul Frontier AI Safety Commitments (2024, voluntary), and AISI agent evaluations — are 2024-25 vintage and have never been measured against an outcome. The scholarship itself has not settled the contested unit of regulation: Kolt (2025) argues for governing the agentic relationship via principal-agent and agency-law tools, while Chan, Ezell, Kaufmann et al. (2024) propose agent-specific visibility mechanisms (identifiers, real-time monitoring, activity logging) that remain proposal-stage and unevaluated — meaning the field has design proposals but, as with most frontier-AI rules, the evidence that any of them works is absent rather than merely thin.

  Sources: Kolt 2025 ('Governing AI Agents', 101 Notre Dame L. Rev., forthcoming; arXiv:2501.07913); Chan, Ezell, Kaufmann et al. 2024 ('Visibility into AI Agents', ACM FAccT 2024, pp. 958-973; DOI 10.1145/3630106.3658948); EU AI Office 2025 (GPAI Code of Practice, July 2025); Seoul Frontier AI Safety Commitments 2024

Related topics

Topics with similar coverage patterns across the tracked instruments.

• Catastrophic & Existential Risk
• Foundation Models / GPAI