Governing AI Agents When None of the Frameworks Covers Them
OECD, NIST AI RMF and ISO/IEC 42001 were all written before autonomous agents. What that gap actually contains, what Singapore's 2026 framework requires, and how to extend what you already run.
If you are being asked to sign off an agent deployment against your existing AI governance framework, there is something you should know before you do: the framework almost certainly does not cover it.
This is not a criticism of the frameworks. It is a matter of dates. The three that enterprises actually run were written for AI systems that produce outputs, and an agent does not produce an output. It takes an action, then another, and the second one depends on how the first went.
Checked 9 August 2026.
The three you are probably running#
Most organisations run a combination rather than one, and each does a different job:
| Layer | Framework | What it is for | Written for agents? |
|---|---|---|---|
| Values | OECD AI Principles | What the organisation says it stands for | No |
| Internal risk model | NIST AI RMF | A flexible, risk-based operating model. Not certifiable | No |
| External proof | ISO/IEC 42001 | The certifiable management system procurement asks about | No |
That combination is sound and worth keeping. The usual adoption path runs eight to twelve months for a moderately complex organisation, with the CIO accountable rather than a compliance team.
None of the three was designed for systems that plan and act autonomously.
What is actually in the gap#
Three things, and they are not variations on familiar risks. They are new because sequence and autonomy are new.
Cascading failure. A model that answers badly produces one bad answer. An agent that reasons badly produces a bad first step, then makes the next decision from the state that step created. The error compounds instead of appearing once, and by the time anything is visible the system is several moves from where it went wrong.
Scope creep. An agent given a goal and a set of tools will use the tools toward the goal, including in combinations nobody enumerated. This is usually described as misbehaviour. It is more accurate to call it the system working exactly as specified by someone who did not realise what they were specifying.
Attribution gaps. When an agent calls a tool that triggers another agent, and something goes wrong three steps later, the question "who did this, under whose authority" often has no recorded answer. Not a disputed answer. No answer.
The first framework written for agents#
Singapore's Model AI Governance Framework for Agentic AI, launched 22 January 2026 at the World Economic Forum, is the first comprehensive governance document that addresses autonomous agents directly.
Its central principle is the one worth taking away even if you never read the document:
An AI agent cannot be a principal. Even when the agent acts independently, the organisation remains responsible, humans remain accountable, and delegation must be explicit and bounded.
It sets out four dimensions: bound the risks up front, make humans meaningfully accountable, implement technical controls, and enable end-user responsibility. It also expects each agent to carry a verifiable identity and an audit trail recording which agent acted under whose authorisation.
That last requirement is the one most organisations will fail today, and it is the one that closes the attribution gap.
How to extend what you already run#
You do not need a new framework. You need four additions to the one you have.
1. A written delegation boundary, per agent. What it may do without a person, and what it must hand over. Not per system, per agent. The boundary is set by the cost of the worst plausible mistake, not by what the agent is capable of.
2. An identity and an audit trail per agent. Every action recorded with which agent took it and under whose authority. If you cannot answer that question from logs today, that is the first gap to close, because every other control depends on being able to reconstruct what happened.
3. A stop condition. Anything repeating more than a small number of times without progress halts and escalates. An agent looping is not resilience, it is a fault being masked, and the loop usually hides the thing you most need to see.
4. A refusal list, written down. What no agent does without a person, whatever its confidence. In our own operation that list is short and specific: nothing irreversible, nothing that changes access or security posture, nothing that releases money, nothing that speaks to a customer, and nothing that closes its own finding.
The test that survives capability improvements#
The temptation is to treat each of those restrictions as a maturity stage to be outgrown as agents get better. It is worth being clear that they are not, because they are not statements about capability.
Every item on a refusal list is a place where somebody must be answerable afterwards, and answerability is not a property a model can hold. A better agent does not change who a regulator, a customer or a court will ask.
So the test is not can the agent do this. It is:
- Is it reversible? How long to undo, and has the undo actually been run?
- Who answers if it is wrong? If the honest answer is "the model decided", the process is wrong regardless of whether it is legal.
What this looks like in practice#
We publish our own version of this rather than describing it in the abstract. Every function in our operating model carries a section stating what is not delegated to an agent and why, including security, where the human approval gate between a risk score and an automated response is deliberate and permanent, and finance, where payment release is never automated at any amount because fraud targets whichever step lacks a person.
The compliance function holds the position on evidence: a control is operating, failing, or unevidenced, and folding the third into the first is how a control quietly stops working for eight months.
Also applicable now: EU AI Act Article 50#
Separately from agent governance, transparency obligations under Article 50 have applied since 2 August 2026. If a person interacts directly with an AI system they must be told, and generated content must be marked. Penalties reach 15 million euro or 3% of worldwide annual turnover.
The Commission adopted guidelines on 20 July 2026, and the AI Office has published a voluntary Code of Practice on Transparency of AI-Generated Content as a recognised route to demonstrating compliance. A transition period closing on 2 December 2026 covers anything that was already on the market before May 2026.
One correction worth making, because it is the most common summary error: the Digital Omnibus deferred certain high-risk obligations to December 2027 and August 2028. Transparency did not move.
FAQ#
Do we need a separate AI governance framework for agents?#
No. You need to extend the one you run. A second framework creates two sources of truth about the same systems, and whichever one is quoted during an incident will be the one the other side has not read.
Is Singapore's framework binding on us?#
Not unless you operate there. It is worth reading anyway because it is currently the only governance document written for agents, and buyers are beginning to ask questions shaped by it.
What is the single first thing to do?#
Write the delegation boundary for one agent, and check whether you can reconstruct from logs which agent took which action under whose authority. Most organisations discover they cannot, and that is the finding.
Does this slow agent deployment down?#
Writing a boundary takes an afternoon. Establishing who was accountable after an incident, without one, takes considerably longer, and it happens with people watching.