Agentic AI in compliance

Agentic AI in compliance refers to AI systems that carry out multi-step compliance work toward a goal, rather than answering one prompt at a time. An agent typically starts on a trigger or a schedule, plans its steps, calls tools such as search, page fetches and databases, writes durable records, and can fail in ways that are logged. A chatbot answers what it is asked; a copilot drafts inside a tool a person is already using; an agent does the work unprompted and hands the result to a person.

The term covers three different questions, and buyers mix them up. The first is agents doing compliance work: monitoring regulators, triaging developments against a company profile and drafting obligations, the subject of AI agents for regulatory compliance. The second is compliance of agents: governing the AI systems a firm deploys, including its duties under the EU AI Act. The third is the "AI compliance officer," usually a human job title for the person who governs AI.

Supervisors have not written agent-specific rules, but they have placed the accountability. The FCA says it does not plan to introduce extra regulations for AI and relies on existing frameworks, including the Consumer Duty and the Senior Managers and Certification Regime, where named individuals carry responsibility (FCA, AI approach). In the US, the banking agencies' revised model risk guidance of 17 April 2026 states that generative and agentic AI models are not within its scope, leaving firms to set controls through their own governance (SR 26-2).

That puts the burden of proof on the record. An agent worth trusting leaves a run record showing its inputs, steps, tool calls, cost, status and errors, and it hands consequential decisions to a person at a human-in-the-loop checkpoint. If a vendor cannot show one complete run record, including a failed run, the "agent" is a scheduled script with a chat window.

This entry is general information, not legal advice.