AI Governance Institute
← News
Corporate Policy2025-05-30

Four Corporate AI Governance Gaps Partnership on AI Says Organizations Must Close Now

What happened

The Partnership on AI published Corporate AI Governance Matters Now More Than Ever on May 30, 2025, identifying four structural deficiencies it argues are present in most corporate AI governance programs. The four domains cited are supply chain responsibility, end-user terms and conditions, AI assurance ecosystems, and real-time monitoring of autonomous AI agents. The publication is global in scope and directed at enterprises that develop, procure, or integrate third-party AI components at scale. While it carries no binding legal force, it draws on documented incident data and emerging regulatory convergence across frameworks including the EU AI Act, ISO 42001, and the NIST AI RMF Playbook. The Partnership on AI is a recognized multi-stakeholder body whose membership includes major technology deployers and civil society organizations, giving the guidance significant practitioner weight.

Why it matters

  • ·Regulatory exposure is elevated because the four gaps identified by the Partnership on AI align directly with conformity obligations under the EU AI Act, DORA, and sector-specific guidance from bodies such as the Financial Stability Board, meaning organizations that have not closed these gaps may face scrutiny as enforcement mechanisms mature.
  • ·Operational impact is immediate for enterprises running agentic AI systems, as the guidance explicitly states that static model documentation and periodic audits are structurally inadequate to govern autonomous agents that execute code, access external data, and initiate transactions without per-action human approval.
  • ·Organizational risk is compounded by AI supply chain complexity, because a single deployed model may incorporate components from multiple upstream providers with distinct training data provenance and update cadences, creating accountability gaps that traditional IT vendor risk management frameworks were not designed to address.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

AGT-011Agent Behavior Monitoring and Anomaly DetectionAGT-016Agentic AI Deployment Readiness AssessmentAGT-019AI Tool and Plugin Supply Chain Risk AssessmentMON-006Behavioral Anomaly Detection for Agentic SystemsPRC-001AI Vendor Due DiligencePRC-017AI Evaluator and Auditor Independence Assessment

What to do now

  • ☐Re-examine your existing AI system inventory to confirm it captures agentic systems and AI components embedded in third-party software, as these are the categories most likely to be absent from prior classification exercises.
  • ☐Audit third-party AI vendor contracts against supply chain responsibility criteria, specifically verifying that agreements require disclosure of upstream model components, training data sourcing practices, and incident notification obligations.
  • ☐Review your agentic AI monitoring controls for implementation completeness, with particular attention to any agents granted tool access, API permissions, or the ability to initiate transactions without per-action human approval.
  • ☐Begin scoping a standing AI assurance function as a continuous organizational capability rather than a project-level activity, defining required tooling, staffing, and reporting cadence.
  • ☐Prioritize agent monitoring and supply chain gap remediation for operations in regulated industries such as financial services, healthcare, and critical infrastructure, given convergent regulatory expectations from DORA and the EU AI Act.

What to watch next

Compliance teams should monitor enforcement guidance from EU AI Act supervisory authorities as they begin operationalizing conformity assessment requirements that align with the continuous assurance model the Partnership on AI describes. Sector-specific signals from the Financial Stability Board and healthcare regulators regarding agentic AI oversight are expected to intensify through late 2025 and should be tracked for additional specificity on real-time monitoring obligations. Organizations should also watch for updated playbooks from NIST and ISO working groups that may translate the assurance ecosystem concept into auditable control frameworks, which would give the Partnership on AI guidance stronger procedural grounding in formal compliance programs.

Related Coverage

Research2026-11-07

AI-Automated Attacks Have Broken Enterprise Incident Response Programs

Alex Stamos, chief security officer at Cognition, calls the current threat environment a 'dark age.' AI tools let attackers automate the entire attack process, from finding vulnerabilities to writing exploits, in real time. A named supply chain breach at Fireworks cascaded through Cursor to roughly 5,000 additional potential incidents, illustrating how AI-accelerated attacks amplify the blast radius of a single vendor compromise. Existing incident response and vendor risk programs, designed for human-speed threats, cannot absorb this pace.

Research2026-11-06

First Accredited AIUC-1 Assessor Sets a New Agent Certification Bar

Sensiba LLP has received full accreditation to conduct AIUC-1 certification assessments. It is the first firm authorized to independently certify AI agents against a standard covering security, safety, and reliability. AIUC-1 assessments combine review of production code, system configurations, and logs with adversarial testing. The accreditation creates a formal third-party certification pathway for enterprise AI agent deployments.

Corporate Policy2026-10-28

Delaware's AI Company Structure Would Shield Humans From AI-Driven Liability

Delaware is advancing a proposal to create an Artificial Intelligence Company (AIC). This new corporate structure allows AI agents to fully manage business operations with no human required to make decisions. Human members who fund an AIC would be insulated from liability for AI-driven harms, except in cases of fraud or willful legal violations. US House Oversight Committee Chairman James Comer has raised objections, warning the structure could enable liability evasion and signaling possible federal legislation to limit state AI regulatory authority.