Businesswoman use agentic ai with ai agent using autonomous workflow for automation represents artificial intelligence innovation and digital transformation

target readers-cv

By Mick Leach

Agentic AI is accelerating enterprise automation, but governance, visibility, and accountability are struggling to keep pace with rapidly scaling autonomous systems.

Agentic AI is moving rapidly from experimentation into real-world deployment, promising efficiency gains that extend beyond traditional automation. But as systems shift from answering questions to pursuing goals autonomously, visibility and accountability are becoming harder to maintain. This article examines why governance is lagging adoption, and what leaders must do before autonomy becomes deeply embedded.

For most organisations, AI adoption to date has followed a familiar pattern. Models are used to answer questions, summarise information, or make recommendations that humans then decide whether to act on. Responsibility remains clearly anchored with people, and AI functions as an assistive layer within established decision-making processes.

Agentic AI is altering that relationship. Instead of responding to individual prompts, these systems are given objectives and the freedom to determine how to achieve them. Once a goal is set, an agent can decide on actions, adapt its approach based on outcomes, and continue operating with limited human input. What appears to be a modest evolution in capability represents a fundamental shift in how work gets done.

This transition moves organisations from using AI to support decisions to delegating execution. Tasks that previously required ongoing supervision can now be carried out autonomously, both at speed and at scale. For leaders, this introduces a new organisational reality: systems that influence outcomes without being fully deterministic or continuously supervised.

But it also reframes risk. When outcomes are produced by systems acting toward goals rather than instructions, how can organisations understand and account for how decisions are being made?

Adoption is racing ahead of governance

The rapid spread of agentic AI is not the result of carelessness. It is driven by pressure.

Organisations are expected to move faster, operate leaner, and extract more value from digital systems. Agentic AI is attractive because it promises to automate outcomes, not just tasks.

Recent developments such as OpenClaw, an open-source solution for connecting AI agents, illustrate how quickly agentic systems can move from concept to widespread use. Once organisations start experimenting with autonomous agents, deployment and connectivity usually starts growing rapidly.

Agentic AI is often introduced as a productivity experiment or a limited pilot. In practice, it begins shaping workflows and decisions almost immediately. Existing governance frameworks usually struggle to keep pace, having largely been built for tools that assist humans rather than act independently.

Many organisations therefore find themselves in an uncomfortable position: technically “using AI responsibly” on paper, while relying on systems whose internal reasoning and data flows are difficult to explain in practice.

Chaining agents makes visibility even more difficult

The most serious challenges with agentic AI do not emerge from individual systems, but from how they interact. An agent designed to perform a single task in isolation may be relatively easy to understand, but complexity increases sharply once agents begin passing outputs, data, or decisions between one another.

In these chained arrangements, one agent’s output becomes another’s input, often without meaningful human review. Over time, it becomes difficult to reconstruct how a particular outcome was reached, which data influenced it, or where responsibility ultimately sits. What begins as a series of reasonable actions can evolve into a process that no single person fully understands end to end.

Think back to the childhood “telephone game” we all played on the playground. Messages are passed along, whispered ear to ear, and changing as they go. By the time it circles back around to the person who first whispered, it’s usually turned into nonsense that bears little resemblance to the original message. Hilarious on the playground, but not so funny when business operations may hinge on accuracy.

With agentic AI, this degradation is structural rather than accidental. Each agent interprets information through its own logic, compounding uncertainty as systems scale.

The risk is not simply that decisions are automated, but that they are accepted without clarity. When outcomes cannot be clearly explained, challenged, or traced back to their origins, businesses begin to erode the foundations of their trust and accountability.

Regulation will apply, even if it does not keep pace

Many organisations rely on regulatory guidance to shape their tech policies, but the rapid pace of AI development has challenged this approach.

The EU Artificial Intelligence Act, for example, does not explicitly reference agentic AI. The regulation was designed to be technology-neutral to remain relevant as AI capabilities evolve. While this helps with longevity, it also means enterprises cannot rely on it for a prescriptive to-do list on managing and securing the latest AI.

Instead, the Act’s core principles – risk classification, human oversight, transparency, and accountability – apply to all systems that operate with autonomy, especially as they take on more responsibility for decisions and actions.

Regulation will always trail innovation, particularly when capabilities evolve faster than definitions can be agreed. It should be treated as a baseline rather than a blueprint, and organisations must define their own standards for governing autonomy.

Organisations looking for guidance can also seek to follow standards like ISO 42001, which provides a framework for structured and responsible AI use. These standards can both help organise AI deployment and provide a proof point for customers and other stakeholders.

Governing before autonomy becomes embedded

Agentic success does not come from rushing to be an early adopter, but from well-planned and deliberate management. Effective governance must be established before autonomous systems become deeply woven into core processes, not after.

This starts with clarity around accountability. When an agent takes action, ownership of the outcome must be clearly defined, even if no individual directed each step. Governance must also prioritise visibility, with a clear and repeatable understanding of what data agents draw on, how decisions flow through systems, and where autonomy begins and ends.

However, while the human touch is crucial, governance does not mean constant intervention. Autonomy can flow smoothly as long as workflows include the ability to observe, question and intervene easily when needed.

Retrofitting these controls later is far more difficult. Once agentic behaviour becomes normalised, introducing new checks or limiting autonomy often meets resistance and creates complexity.

Efficiency without understanding is a fragile advantage

Agentic AI has powerful potential for productivity benefits and will be an important competitive differentiator in the years ahead. Systems that can pursue goals autonomously promise speed and scale beyond traditional automation.

But efficiency without understanding is fragile. When organisations accept outcomes they cannot clearly explain, they exchange short-term gains for long-term risk.

Those organisations that establish visibility and accountability early will be better positioned as autonomy becomes the norm. Following regulations and frameworks such as ISO 42001 will help build trust and demonstrate a focus on reliable, responsible AI.

Meanwhile, those who rushed in may find that by the time governance arrives, autonomous systems are too opaque and deeply embedded to be easily understood, let alone reined in.

About the Author

Mick LeachMick Leach
is Field CISO of Abnormal Security, an AI-native email security company that uses behavioral AI to prevent business email compromise, vendor fraud, and other socially-engineered attacks. At Abnormal, he is responsible for threat hunting and analysis, engaging with customers, and is a featured speaker at global industry conferences and events.

LEAVE A REPLY

Please enter your comment!
Please enter your name here