For years, reviewing an AI system meant one thing. Someone checked its outputs against a representative set of test cases, confirmed it behaved acceptably, signed off, and moved on. That process made sense for exactly as long as AI's job was to generate an answer and hand it to a person who decided what happened next.

Agentic AI does not wait for that person. It books the appointment, sends the email, queries the database, executes the trade, adjusts the configuration. The review still happens. It has simply stopped being the thing that determines what the system is allowed to do once it is live.

Why review-then-approve worked, until it did not

A traditional model has a bounded job. Answer this question, classify this document, generate this summary. Test it against enough realistic cases and you get a reasonable picture of how it will behave, because the range of things it can do is narrow and the consequence of any single output is usually that a human reads it and decides.

An agent's job is not bounded in the same way. It can chain several actions together, call other tools, decide the order in which to do things, and adapt when the first approach does not work. Reviewing it before launch means reviewing its intended behaviour, in the scenarios someone thought to test. It was never going to mean reviewing every sequence of actions it might eventually chain together once it is handling real requests it was not specifically tested against.

This is not a flaw in how anyone has been doing reviews. It is a mismatch between what a one-time review can verify and what an autonomous system does over time.

The numbers say this gap is not closing on its own

Deloitte's 2026 State of AI in the Enterprise survey, covering 3,235 IT and business leaders across 24 countries, found that only 21 percent describe their organisation's governance model for agentic AI as mature. That is not a fringe finding. It is the majority position among leaders already running these systems in production.

Meanwhile the deployment curve is not waiting for governance to catch up. Gartner projects that 40 percent of enterprise applications will have task-specific AI agents embedded by the end of 2026, up from under 5 percent in 2025. Adoption is not the slow-moving part of this story. Oversight is.

There is a harder number worth sitting with, because it reframes this as a cost problem, not only a risk problem. Gartner also projects that more than 40 percent of agentic AI projects will be cancelled before 2027, and identifies governance failure, not cost overrun or unclear business value, as the primary preventable cause. Organisations are not just carrying risk quietly in the background. A meaningful share of them are going to lose the investment entirely, for a reason that was avoidable from the start.

Regulators have not caught up either, and some have said so directly

It would be reassuring if there were a settled rulebook to follow here. There is not, and in at least one case the gap is written into the regulation itself rather than just implied by its absence.

In April 2026, the US Federal Reserve, OCC, and FDIC issued revised joint guidance on model risk management, SR 26-2. It explicitly excludes generative and agentic AI models from its scope, describing them as "novel and rapidly evolving" and deferring their governance to general organisational risk management practice instead. The primary supervisory framework banks have relied on for model governance does not currently reach the autonomous agents already operating inside consumer-facing financial systems.

The pattern repeats elsewhere. NIST's Center for AI Standards and Innovation opened a request for information on agent-specific risk in January 2026. The National Cybersecurity Center of Excellence published a concept paper in February 2026 proposing how existing identity standards might extend to AI agents. A concept paper is an early step toward guidance, not guidance itself. Waiting for a finished framework before building internal oversight is not currently an option, because the finished framework does not exist yet.

What closes the gap a one-time review cannot

None of this means design-time review is worthless. Catching a problem before a system goes live is still cheaper and more durable than catching it afterward. The distinction is one Aligne has written about in more general terms already, and agentic AI is simply the sharpest possible illustration of why the runtime half of that distinction cannot be optional once software is empowered to act.

For an agent specifically, closing the gap tends to come down to a small number of concrete things. A permission boundary that is technically enforced, not just written down, so an agent cannot take an action nobody explicitly allowed regardless of how it reasoned its way there. A checkpoint where human sign-off is genuinely required and verified, not merely designed into a diagram nobody enforces in production. A complete record of what the agent did and in what order, so a question about a specific outcome has a real answer rather than a best guess. A way to stop an agent's behaviour immediately when it starts doing something nobody anticipated, rather than discovering it in a retrospective days later.

These are runtime properties. None of them can be established by reviewing the model once before launch, no matter how thoroughly that review is done.

A short way to check where your own organisation stands

Two questions tend to surface the real answer faster than a lengthy audit. If one of your AI agents took an unexpected action right now, autonomously chaining a step nobody explicitly reviewed, would anything stop it before it completed, or would you find out afterward. And if a regulator or a board member asked for a complete record of what a specific agent did last week and why, could that record be produced today, or would producing it require reconstructing the answer after the fact.

A confident, evidenced yes to both is rare right now, which is exactly what Deloitte's 21 percent figure is describing. An honest no to either is not a reason for alarm. It is a precise description of where the actual work still needs to happen.

Common questions

Is agentic AI governance just AI governance with extra steps? Not quite. Traditional AI governance was built around reviewing outputs a human would then act on. Agentic AI governance has to account for the system acting directly, which means the emphasis shifts from reviewing intended behaviour once to enforcing actual behaviour continuously.

Do smaller organisations need to worry about this, or is it mainly a large enterprise problem? The exposure scales with how much autonomy an agent has and what it is connected to, not with headcount. A smaller organisation with one agent that can access customer records or execute payments carries a version of the same risk as a much larger one running dozens of agents.

With no finished regulatory framework yet, what should we be building toward? The control layers that keep appearing across current guidance, incomplete as it is, are consistent: identity and access boundaries for agents, continuous behavioural monitoring, enforced human checkpoints at the steps that genuinely matter, and a complete audit trail. Building toward those now means not starting from zero once a finished framework eventually arrives.

Where an organisation reviewed its AI agents before launch and has not revisited what they are doing since, that gap is common, and closing it does not require waiting for a regulator to tell you how. Aligne's platform, Altrum AI, was built around exactly this distinction, covering both the design-time review and the runtime enforcement agentic systems specifically need. You can see how that works here.

‍