Static AI Governance Models Are Inadequate for Agentic Systems, Info-Tech Research Group Warns in New Blueprint

What happened

Why it matters

• ·Enterprises relying on point-in-time approval workflows for AI deployments face compounding regulatory exposure as agentic systems make decisions and take actions between review cycles, with no current checkpoint to catch drift or scope expansion.
• ·The accountability requirement for every AI application, not just high-risk or externally facing ones, widens the scope of internal control programs significantly and challenges resource allocation assumptions built around tiered risk models.
• ·Organizations that have not operationalized continuous monitoring for AI systems are poorly positioned as regulators and standards bodies converge on lifecycle accountability requirements, making the gap between current practice and emerging obligations increasingly visible to auditors and counterparties.

Governance controls affected

What to do now

• ☐Audit your current AI approval workflow to identify whether controls terminate at deployment or extend through the full operational lifecycle of each system.
• ☐Map all agentic AI deployments against the five blueprint domains (governance, risk, compliance, assurance, lifecycle integration) and identify which domains currently lack assigned ownership.
• ☐Replace or supplement any static risk tier assigned at intake with a continuous reassessment mechanism that triggers when agent scope, permissions, or tool access changes.
• ☐Establish a minimum accountability record for every AI application in production, regardless of risk tier, documenting the responsible owner, review cadence, and escalation path.
• ☐Benchmark your continuous monitoring capabilities against the blueprint's assurance requirements and document gaps for the next governance committee review cycle.

What to watch next

Compliance teams should watch for regulatory frameworks incorporating continuous lifecycle accountability requirements as a baseline obligation rather than a best practice, particularly as the IMDA Model AI Governance Framework for Agentic AI and similar national frameworks continue to mature. The convergence between research group blueprints, regulator signals such as the Bank of England's signals on bespoke agentic AI rules, and practitioner tooling suggests that adaptive governance is transitioning from advisory to expected. Teams should also monitor whether insurance, audit, and investor communities begin referencing continuous assurance as a condition of coverage, attestation, or capital allocation.