The Fundamental Shift: From Tools to Delegates
When boards approved the deployment of enterprise software in previous decades, they were sanctioning tools—instruments that amplified human capability but remained firmly under human control. The spreadsheet calculated, but a human decided. The ERP system processed, but a human approved. This paradigm has fundamentally shifted with the emergence of agentic AI systems, and most boards have not yet grasped the governance implications.
Agentic AI represents something categorically different from the chatbots and copilots that dominated corporate AI discussions in 2023 and 2024. These systems do not wait for prompts. They plan multi-step strategies, execute complex workflows, call external APIs, initiate transactions, and operate with genuine autonomy. When a board approves the deployment of an agentic AI system, they are not approving a tool—they are delegating authority to a non-human actor.
I built an EPC business to 450 people as its CEO and now chair a board I constituted; from both seats, I have watched this transition up close. One industrial organization I observed deployed what it initially considered an "intelligent procurement assistant" that could autonomously negotiate with suppliers, issue purchase orders within defined parameters, and manage vendor relationships. Within three months, its leaders realized they had not deployed software—they had created a new category of organizational actor that required governance frameworks they simply did not have.
The statistics are sobering. According to recent surveys, 66% of directors now use AI for board work, yet fewer than 20% of boards have established formal policies governing AI deployment, let alone the specific challenges posed by agentic systems. This governance gap represents one of the most significant risks facing corporate leadership in 2026.
The EU AI Act and the New Regulatory Reality
The enforcement of the EU AI Act beginning in August 2026 has transformed agentic AI governance from a best practice into a legal imperative. The Act's risk-based classification system places many agentic AI applications—particularly those making decisions affecting employment, creditworthiness, or essential services—into high-risk categories requiring extensive documentation, human oversight mechanisms, and ongoing monitoring.
For boards, this creates several immediate obligations:
- Transparency requirements: Organizations must maintain detailed documentation of how agentic systems make decisions, including the training data, algorithmic logic, and decision boundaries. Boards must ensure these documentation systems exist and are regularly audited.
- Human oversight mandates: High-risk AI systems must include mechanisms for human intervention and override. Boards must define what constitutes meaningful human oversight when systems operate at machine speed across thousands of decisions daily.
- Accountability structures: The Act requires clear assignment of responsibility for AI system outcomes. Boards must establish whether accountability rests with the AI vendor, internal IT leadership, business unit heads, or the board itself.
- Conformity assessments: Many agentic systems will require third-party conformity assessments before deployment. Boards must integrate these assessments into their technology governance processes.
The extraterritorial reach of the EU AI Act means that companies operating globally—including those headquartered in the UAE, United States, or Asia—must comply when their AI systems affect EU residents. This regulatory reality demands board-level attention regardless of corporate domicile.
Redefining the Delegation of Authority Framework
Every well-governed organization maintains a delegation of authority matrix—a document specifying who can approve expenditures, sign contracts, hire employees, and make binding commitments on behalf of the organization. These frameworks have historically assumed human actors. Agentic AI breaks this assumption.
Boards must now answer questions that have no precedent in corporate governance:
What decisions can an AI agent make autonomously? This requires defining not just monetary thresholds but decision categories. An agentic system might be authorized to approve routine purchase orders up to a certain value but prohibited from making any decisions involving employee termination, regardless of the financial impact.
What constitutes adequate supervision? Traditional delegation assumes a supervisor can review a subordinate's decisions. When an agentic system makes thousands of decisions per hour, what does meaningful supervision look like? Boards must define sampling methodologies, exception reporting thresholds, and escalation triggers.
How do we handle agent-to-agent interactions? As agentic systems proliferate, they increasingly interact with each other—your procurement agent negotiating with a supplier's sales agent. Boards must consider the governance implications of autonomous systems making binding commitments through machine-to-machine communication.
I have found it useful to think of agentic AI governance through the lens of how we govern human delegates with limited judgment. We do not give a junior employee unlimited authority and hope for the best. We define boundaries, require reporting, conduct audits, and maintain override capabilities. The same principles apply to agentic systems, but the implementation requires new mechanisms.
Practical Governance Mechanisms for Agentic AI
Moving from principles to practice, boards should consider implementing the following governance mechanisms:
Agentic AI Registry and Classification
Organizations should maintain a comprehensive registry of all agentic AI systems, classified by autonomy level, decision authority, and risk category. This registry should be reviewed by the board or a designated committee at least quarterly. Each system should have a designated human owner accountable for its behavior and outcomes.
Boundary Definition and Enforcement
For each agentic system, boards should approve explicit operational boundaries covering financial limits, decision categories, interaction permissions, and escalation requirements. These boundaries should be technically enforced, not merely documented. The system should be architecturally incapable of exceeding its authority, not simply instructed not to do so.
Audit Trail and Explainability Requirements
Every decision made by an agentic system should be logged with sufficient detail to reconstruct the reasoning process. This is not merely a regulatory requirement—it is essential for organizational learning and liability management. Boards should receive regular reports summarizing agentic system decisions, with particular attention to edge cases and near-boundary decisions.
Kill Switch and Override Protocols
Boards must ensure that every agentic system can be immediately suspended by authorized personnel. This requires not just technical capability but clear protocols specifying who can invoke suspension, under what circumstances, and what happens to in-flight transactions when a system is halted.
Vendor and Third-Party Governance
Many organizations deploy agentic AI through third-party platforms. Boards must ensure that vendor contracts address liability allocation, audit rights, data ownership, and the vendor's obligations regarding system updates that might change agent behavior. A vendor update that expands an agent's capabilities could inadvertently exceed the authority boundaries the board has approved.
The Board's Evolving Role in an Agentic Future
The rise of agentic AI does not diminish the board's role—it elevates it. As operational decisions increasingly flow through autonomous systems, the board's responsibility for setting boundaries, defining values, and ensuring accountability becomes more critical, not less.
This requires boards to develop new competencies. Directors need not become AI engineers, but they must understand enough about agentic systems to ask penetrating questions and evaluate management's responses. They must be able to distinguish between genuine technical constraints and convenient excuses. They must understand the difference between an AI system that cannot exceed its boundaries and one that merely should not.
Boards should also consider their committee structures. Some organizations are creating dedicated AI governance committees; others are expanding the mandate of existing technology or risk committees. The right structure depends on the organization's AI maturity and risk profile, but the worst approach is to leave agentic AI governance orphaned between committees.
As I reflect on my responsibilities as both a CEO and the chair of a board I built, I recognize that we are in a transitional moment. The governance frameworks we establish in 2026 will shape how organizations relate to autonomous systems for decades. We have the opportunity—and the obligation—to get this right.
The boards that treat agentic AI as merely another technology deployment will find themselves governing organizations they do not fully control. The boards that recognize agentic AI as a fundamental shift in how authority is delegated and exercised will build organizations capable of harnessing these powerful systems while maintaining the accountability that stakeholders demand and regulators require.
The question is not whether to deploy agentic AI—competitive pressures make that inevitable for most organizations. The question is whether boards will govern these systems with the same rigor they apply to human delegates, or whether they will abdicate their oversight responsibilities to algorithms they do not understand. The answer to that question will define corporate governance for the next generation.