AI Governance 9 min read August 2026

Regulating Yesterday's AI: Agents and the Rules Written Before Them

Two things happened this year that, read together, raise an awkward question.

In Brussels, the EU AI Act partially came into force. From 2 August 2026, the AI Office and the authorities of the Member States became responsible for enforcing the Act, and the transparency rules took effect. But the AI Omnibus, in force since 27 July 2026, extended the rules for high-risk use cases in sensitive areas to 2 December 2027, and those for AI embedded in regulated products to 2 August 2028.

In Bern, nothing came into force at all. There is not yet any overarching Swiss legislation dealing specifically with AI. A bill implementing the Council of Europe's AI Convention is to be submitted for consultation by the end of 2026, covering transparency, data protection, non-discrimination and supervision.

Meanwhile, the technology most organisations are actually deploying is agentic AI. Neither framework was designed with it in mind. Are these rules already out of date before they fully arrive?

Why the Question Is Fair

The EU AI Act is built on a product-safety architecture. A provider places a system on the market, declares an intended purpose, completes a conformity assessment. A deployer then uses it according to instructions. That works for a static artefact. Agents strain every assumption in it.

Intended purpose becomes fluid. Classification hangs on what a system is intended for. An agent assembles its effective purpose at runtime, per task, from an objective and whatever tools it decides to call.

Pre-market assessment becomes a snapshot. Agent behaviour depends on the tools available to it, the memory it has accumulated, and the context of the task. What you assessed is not what runs.

The provider and deployer line blurs. A firm that wraps an off-the-shelf model in its own orchestration logic has done something close to substantial modification. In multi-agent chains, the actor categories stop mapping cleanly.

Human oversight assumes an intervenable moment. The Act requires appropriate human oversight, which presumes a decision point where a person can step in. Agents act at machine speed, and the consequential moment is often step seven of twelve.

The Irony Inside the Delay

The Commission is explicit about why the high-risk regime moved. The new timeline, in its own words, ensures the rules apply when companies have the right support tools to facilitate implementation, such as standards. Read that plainly: the rules were postponed because the standards they will be measured against are not ready. So the standards are still being written, against the original architecture, to bind from December 2027.

A second timing detail is worth noticing. The Commission published its Guidelines on transparency obligations on 20 July 2026, thirteen days before the obligations they govern became enforceable.

Switzerland's position is different, but not obviously better. The Council of Europe Convention is principles-based, which ages more gracefully than technical specification. But principles alone tell you nothing about what to do with an agent holding API credentials and a spending limit.

The Most Current Framework Is Not a Law

This reframes the whole question. Singapore's Infocomm Media Development Authority (IMDA) launched its Model AI Governance Framework for Agentic AI in January 2026, the first in the world to include a comprehensive guide for enterprises deploying agentic AI responsibly. IMDA explicitly describes it as a living document and invites case studies to refine it. It was updated four months later.

The EU took roughly two years of legislative process to move one set of dates.

IMDA is also not alone in moving faster than legislatures. But it is worth being precise about what the rest of that work is, because two different layers are routinely lumped together.

The governance layer asks who is accountable, where humans intervene, and how decisions get documented and reviewed. IMDA's framework sits here, as does ISO/IEC 42001, the certifiable management-system standard for AI.

The security layer asks how an agent gets attacked and what breaks when it does. OWASP, the Open Worldwide Application Security Project, is the non-profit community behind the security risk lists most engineering teams already use; its GenAI Security Project released the Top 10 for Agentic Applications 2026 in December 2025, a peer-reviewed taxonomy of risks specific to systems that plan, use tools, persist memory and coordinate with other agents. NIST launched its AI Agent Standards Initiative in February 2026, focused on how agents authenticate, what authorisation they carry, and how they interoperate securely.

These two layers are not substitutes for each other. A security taxonomy tells you what to threat-model; it does not tell you who signs off. A governance framework tells you who is accountable; it does not tell you that memory poisoning exists. An organisation deploying agents needs both, and the law currently supplies neither at the level of detail either one offers.

None of it binds anyone. All of it is more current than the law.

That is not a criticism of European lawmaking, which is deliberately slow for good constitutional reasons. It is an observation about where operational currency lives. Treat law as the floor. Treat living frameworks as the operating manual.

Generative and Agentic: The Difference That Matters

A generative system responds. You prompt it, it produces output, you decide what to do with that output. The failure mode is a bad answer, and damage only occurs if a human accepts it and acts.

An agent acts. Agentic systems plan across multiple steps to achieve specified objectives. Unlike generative AI, which responds to prompts, agents take actions, adapt to new information, and interact with other agents and systems on behalf of humans. The failure mode is no longer a bad answer. It is a completed action.

Reversibility. A wrong summary can be discarded. A wrong payment cannot. An agent that has sent an email or triggered a workflow has already changed the world by the time anyone reviews it.

Blast radius. A generative error affects one output. An agent in a loop repeats the same error across hundreds of records, because there is no human checkpoint between iterations.

Error compounding. Step three inherits step two's mistake and builds on it. A small misreading becomes a confidently executed wrong outcome, with a plausible-looking audit trail behind it.

Identity and attribution. This is the gap the NIST initiative is built around, and it is the unglamorous problem underneath everything else. Agents are commonly deployed with no identity of their own, inheriting a shared account or a service credential. If you cannot say which agent acted under whose authority, you have no accountability chain at all.

Unbounded consumption. A generative system makes roughly one model call per request. An agent iterates until it decides it is done, and the number of calls is not known in advance. Context accumulates within the task, so cost per step rises as it progresses, and an orchestrator calling several specialists does not add this effect, it multiplies it. This is where automation business cases quietly break: a salary is fixed, predictable and capped, while inference cost is demand-driven and unbounded unless you bound it deliberately. Replacing the first with the second is not automatically a bad trade, but it compares a fixed number to a distribution.

One consequence runs through all six. A generative system that drafts badly creates an internal quality issue. An agent that executes wrongly against a client account creates an external event. In a supervised sector, that is the difference between an internal note and a conversation with the regulator.

The Four Pillars, Translated

The IMDA framework structures agentic risk reduction around four dimensions:

Translated into practice, they produce five things worth doing.

Bound the risk before deployment. Agent risk depends on the domain's tolerance for error, access to sensitive data, reversibility of actions, and task complexity. Limit access to the minimum tools and data required, define standard operating procedures, and design offline mechanisms for malfunctions. Give agents unique identities tied to supervising users, and threat-model for memory poisoning, tool misuse and privilege compromise. Three questions before go-live: what can it touch, what can it not undo, and how do we turn it off. If the answer to the third involves a vendor support ticket, you do not have a kill switch.

Make oversight meaningful. The framework recommends guarding against automation bias by monitoring human override rates and response times. Override rate is the sharpest diagnostic in the entire document. If it is near zero, you do not have oversight. You have theatre. And note what real oversight costs: catching a confident error requires someone who understands the work well enough to spot it, which is a senior role, not a junior one. Organisations that automate cheap hours often discover they have bought expensive ones.

Choose structural controls over prompt-layer ones. The framework distinguishes structural and rule-based controls from model-based or prompt-layer controls. A prompt instruction is a request. A permission boundary is a control. No auditor accepts the first as evidence of the second.

Instrument consumption as a safety signal. Because agents loop, token consumption is a leading indicator of malfunction. An agent that suddenly costs three times more per task is telling you it is looping, retrying, or failing to converge, and that signal usually appears before the harmful outcome does. Among the cheapest structural controls available:

All three depend on the unique agent identities above: if you cannot tell which agent spent what, you cannot tell which agent is failing.

Preserve the skill you are automating. The framework flags the impact on tradecraft and business continuity when agents take over entry-level work. This lands hardest in high-wage markets like Switzerland, where the roles agents handle most easily are also the most expensive to keep, so they go first: alert triage, document review, first-line queries, reconciliation. But entry-level work is how junior staff learn how the business actually works. Remove it entirely and in five years there is nobody qualified to supervise the agents. A team that has not performed a process manually in eighteen months cannot simply resume it when the agent is unavailable. That is a continuity risk, not a sentimental one.

The failure mode that governance has to be designed around is not the loud one. An agent rarely stops and announces that it is stuck. It proceeds, plausibly and confidently, and the error surfaces later, having already propagated. That is exactly what pre-market conformity assessment does not catch.

So, Are the Rules Outdated?

Partly. And that is the wrong thing to wait on.

But notice what the Swiss approach quietly gets right. The Federal Council's direction relies on sector-specific measures alongside cross-sectoral rules in fundamental-rights areas, with non-binding instruments such as industry solutions planned in parallel. Agent risk depends more on the domain the agent acts in than on the technology itself. An agent moving money, an agent triaging patients, and an agent scheduling meetings are three entirely different risk propositions running on identical architecture. A horizontal risk classification struggles with that. Sectoral supervision, already continuous and staffed by people who understand the domain, handles it more naturally.

Which points to the real answer. Do not build your AI governance around a statute. Build it around the four questions that stay true regardless of which framework eventually binds you.

The Four Questions

  • What can this system do?
  • What can it not undo?
  • Who is accountable?
  • How would we know if it went wrong?

This is also why the governance layer outlasts the security layer, useful as both are. A management-system standard such as ISO/IEC 42001 governs how an organisation decides, documents and reviews, not what the technology happens to be this year. Attack taxonomies will be rewritten as attacks change. The four questions above will not. They were as relevant to a credit scorecard as they are to an agent, and they will survive whatever comes after agents.

Organisations that can answer those today will comply with whatever arrives in 2027, in Brussels or in Bern. The ones waiting for the law to tell them what to do will find that by the time it does, it is describing a version of the technology they stopped using two years earlier.

Sources: European Commission, AI Act regulatory framework and Guidelines on transparency obligations; Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744; Swiss Federal Chancellery, Artificial Intelligence; IMDA Model AI Governance Framework for Agentic AI, updated May 2026; OWASP GenAI Security Project, Top 10 for Agentic Applications 2026 and State of Agentic AI Security and Governance, June 2026; NIST AI Agent Standards Initiative, February 2026; ISO/IEC 42001:2023.

Drafted with AI assistance under the author's direction and editorial review. Framing, argument and conclusions are the author's own; all factual claims and sources have been verified against the primary documents cited above.