Govern your AI agents before they act on their own
An AI agent doesn't just answer: it sends emails, changes records or triggers payments. If you don't know which agents you have, what they can do and who is accountable for them, the risk is yours even if nobody decided to take it.
The plan in three steps
- 1Know which agents you have
- 2Set limits on what they do
- 3Be able to prove what they did
An agent is not a chatbot
An assistant that drafts text is like a copywriter: someone reviews what it writes. An agent is like an employee with access to your systems.
It acts
It doesn't stop at an answer: it sends, changes, buys or deletes. If it gets something wrong, the error has already happened.
It chains
It calls other tools and other agents. The final result belongs to the whole chain, not to one piece.
It remembers
It keeps memory between tasks, sometimes with personal data. You have to decide what it remembers and for how long.
What has been published on agents in 2026
The AI Act has no chapter on agents: they are classified like any AI system, by their use. But in 2026 several regulators set out how they look at them.
European Commission
The high-risk guidelines assess a chain of agents as a single system when together they serve an Annex III use.
Read the analysis →Guidance · 18 Feb 2026AEPD (Spain)
An 81-page guide on agents and data protection: dedicated governance, the data protection officer and memory control.
Read the analysis →Exploratory note · 20 Jul 2026CNIL (France)
Eight pointers: full traceability, memory partitioned by agent, risk-based human approval and a kill switch.
Read the analysis →Report · Jan 2026ICO (United Kingdom)
The UK data protection authority published its first analysis of agentic AI in January.
See the reference →Voluntary framework · 22 Jan 2026IMDA (Singapore)
A governance framework for agentic AI: limits by design, accountable humans with approval points and the ability to switch off.
See it in the radar →Expected · end of 2026EDPB and European Commission
Joint guidelines on how the GDPR and the AI Act fit together, with attention to agentic AI.
See it in the radar →Where to start with your agents
The same order regulators follow: know what you have, set limits and be able to prove it.
Know which agents you have
Build an inventory: which agents exist, who is accountable for each, which data and systems they access and whether the chain ends in a high-risk use.
Set limits
Decide what each agent may do on its own, what needs human approval (payments, deletions, anything sent outside the company) and how it is stopped.
Be able to prove it
Record what each agent did, when and with which data, and make clear who is accountable when several agents work together.
An agent is only as reliable as the data it uses
An agent decides and acts with the information you give it access to. If the data is duplicated, out of date or has no owner, the agent repeats those errors, and faster than a person would.
That is why agent governance starts with data governance: knowing what data exists, who is accountable for it and how good it is.
Already using AI in your company?
Free AI Governance assessment: if you have agents, it tells you where to start.
Take the assessmentFrequently asked questions
Does the AI Act regulate AI agents?
It has no chapter of its own on them. An agent is classified like any AI system, by its use. If a chain of agents serves an Annex III high-risk use, those obligations apply, which in the EU start on 2 December 2027.
Is a chatbot an agent?
If it only answers, it is an assistant. If it also does things on its own (creates an order, sends an email, changes a record), treat it as an agent.
If I use a vendor's agent, is the vendor responsible?
Not entirely. The company that uses it decides which data and systems it can access and what it may do, and is accountable for that use. Review the vendor contract too.
Where do I start?
With the inventory: which agents exist, who is accountable for each and what they can do. Without it you can't set limits or prove anything.
Do you have agents running?
Start by knowing which ones. The templates follow the same order as this page.