Signal Agentic AI Outpaces Existing Governance Frameworks

Summary

Agentic AI executes decisions independently rather than assisting human ones, a mode neither the EU AI Act nor the NIST AI RMF assumed when they were designed. Both frameworks now cover a technology whose defining feature they did not anticipate. Cloud Security Alliance research confirms none of the major frameworks — the NIST AI RMF, ISO/IEC 42001 or the EU AI Act — contain any reference to “agent,” “agentic” or autonomous AI systems, because agentic systems act on external systems, access tools dynamically, execute multi-step plans where errors cascade, and delegate across agent boundaries in ways that fragment accountability. Singapore's IMDA published the first comprehensive governance framework for autonomous agents in January 2026, requiring each agent to carry a verifiable digital identity and an audit trail of which agent acted under whose authorisation. NIST's Center for AI Standards and Innovation launched an AI Agent Standards Initiative in February 2026, with a full AI Agent Interoperability Profile planned for the fourth quarter of 2026. AI agents are projected to appear in 40% of enterprise applications by 2026, up from less than 5% in 2025, a scale-up that analysts say outpaces governance built around human-paced review cycles.