Agentic AI Deployments Outpacing Enterprise Controls, Deloitte Research Finds

What happened

Why it matters

• ·Regulatory exposure is escalating: frameworks including the EU AI Act and Singapore's IMDA Agentic AI Governance guidance already contemplate human oversight and auditability requirements for autonomous systems, and organizations without documented action boundaries and audit trails will struggle to demonstrate compliance when enforcement attention arrives.
• ·Operational risk is compounded by autonomy: unlike conventional AI models that generate outputs for human review, agents can execute sequences of irreversible actions across enterprise systems, meaning a single control gap can propagate consequences across procurement, data, communications, or financial workflows before any human reviewer is aware.
• ·Governance programs built for predictive models are structurally mismatched to agents: existing AI risk registers, incident response playbooks, and human-in-the-loop frameworks were largely designed for decision-support tools, and the Deloitte findings signal that retrofitting those controls for agentic contexts requires deliberate redesign rather than incremental adjustment.

Governance controls affected

What to do now

• ☐Audit all currently deployed or piloted AI agents to document their permission boundaries, the systems they can access, and the actions they can take without human approval, then compare that inventory against AGT-001 and AGT-004 control requirements.
• ☐Verify that chain-of-action logging is implemented for every agent deployment, capturing each step in a tamper-evident log with sufficient detail to reconstruct the full sequence of agent decisions and actions for audit or incident review.
• ☐Assess whether existing anomaly detection tooling covers agentic behavior specifically, including unexpected tool invocations, scope expansion attempts, and deviation from baseline task patterns, and document gaps against MON-006.
• ☐Establish or update human-in-the-loop approval gates for agent actions that are irreversible or that exceed defined risk thresholds, and confirm that reviewers have the competency to evaluate the agent's action chain rather than just its final output.
• ☐Incorporate agentic AI control gaps identified through this review into your next board AI risk report, including a remediation timeline, so that senior governance bodies have visibility into deployment-versus-control maturity mismatches.

What to watch next

Organizations should monitor whether financial sector regulators, including those overseeing operational resilience under DORA in the EU and analogous frameworks in the UK and US, begin issuing specific expectations for agentic AI oversight as agent use in finance scales. Singapore's IMDA has already published governance guidance specific to agentic AI, and further jurisdictions are expected to follow with binding or semi-binding requirements over the next 12 to 18 months. Enforcement actions or supervisory inquiries that cite inadequate monitoring or audit trails for autonomous systems would be a significant signal that the voluntary remediation window is closing.