PwC Tells Financial Firms to Govern Agentic AI as Enterprise Risk, Not Tech Risk
What happened
PwC UK published Agentic AI: Preparing for Greater Regulatory Attention on 2 October 2026, targeting financial services compliance and risk functions. Agentic AI systems can act on behalf of a firm, make decisions, and trigger downstream consequences without direct human sign-off each time. The guidance argues these systems require governance calibrated to their autonomy and business criticality, not generic technology controls. PwC recommends that firms maintain inventories of all material agentic systems and define explicit boundaries on what actions each system may take. Firms should also set clear escalation rules when those boundaries are approached. Re-testing is required whenever any component changes, including the underlying model, the instructions given to it, the data it draws on, or the tools it can use. The paper positions this work as preparation for regulatory attention already materialising in the UK. This is consistent with signals from the FCA Finds UK Firms Deployed AI Before Governance Was in Place finding. It also aligns with the ICO Sets Binding-Standard Expectations for AI Agents Under UK GDPR guidance.
Why it matters
- ·UK financial regulators are already examining whether firms have adequate agentic AI controls in place. The FCA and ICO have both issued signals that existing rules apply now. Firms without inventories or documented action boundaries face examination risk today, not at some future compliance date.
- ·The PwC framing shifts ownership of agentic AI risk from IT or technology teams to enterprise risk and compliance functions. Firms that have not yet assigned clear accountability for agentic systems across business lines face a structural gap. That is the same gap that JPMorgan and HSBC Embed AI Governance Into Firm-Wide Risk Structures were built to close.
- ·The re-testing requirement on every component change, including model updates, instruction changes, and data or tool additions, creates a continuous assurance obligation. Firms that test only at initial deployment and treat later changes as minor updates will struggle to demonstrate compliance if an incident occurs.
Governance controls affected
What to do now
- ☐Produce a written inventory of every agentic AI system your firm operates or procures, including systems run by third parties on your behalf, and map each one to a named internal owner in a risk or compliance function, not only a technology team.
- ☐For each agentic system in the inventory, document in plain language what actions it is permitted to take, what it is explicitly prohibited from doing, and what triggers a human review before the system proceeds.
- ☐Establish a re-testing requirement that triggers whenever the underlying model version, the instructions given to the agent, the data sources it accesses, or the external tools it can use are changed, and record evidence of each re-test.
- ☐Ask your legal and compliance team to confirm that your existing vendor contracts require the vendor to notify you before making changes to model versions or tool integrations that could alter agent behavior.
- ☐Prepare a one-page summary for your board or audit committee showing which agentic systems are in production, who owns them, and whether each has documented action boundaries and a current test record, ready for a regulatory examination request.
What to watch next
UK financial services firms should watch for further FCA supervisory activity on AI governance gaps. They should also monitor ICO enforcement actions involving agentic data processing. Both are now active areas of regulatory attention. The PwC framing also anticipates future binding requirements building on the voluntary and principles-based guidance currently in force under the UK AI Regulation Framework. Internationally, the Five Eyes Guidance on the Careful Adoption of Agentic AI Services is establishing comparable control expectations. So is the MAS Guidelines on Artificial Intelligence Risk Management. Together they give compliance teams a useful benchmark for building programs that will travel across jurisdictions.
Stay ahead of stories like this
Get every UK AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- Regulators, litigants, and attackers are all moving faster than most organizations' AI governance frameworks, shifting leverage away from deployers and toward those who can prove control, accountability, and honest disclosure.21 Oct
- Three separate incidents this week reveal that AI vendors cannot be trusted to self-police, and that harm from deployed agents can run unchecked for months before anyone inside the organization notices.15 Oct
Free every Thursday. Unsubscribe anytime.