Your AI agents answer to your regulators too – 2 minute video
Transcript
Your agents have to follow the regulations your firm already does, like GDPR, DORA and fair lending.
Agent Authority ensures every agent action passes your Enterprise Charter, written once by your risk and compliance team. Every agent inherits it. No agent can edit it or skip it. Here are three examples.
GDPR and personal data The service agent wants to paste a customer’s account details into an outside AI tool to summarise a complaint. The Enterprise Charter says customer data never leaves approved systems. Agent Authority denies it before it runs. The data stays put.
Fair lending The lending agent is about to decline a small-business loan. The charter says final credit decisions belong to a person. Agent Authority holds it for a credit officer, who decides. The reason is recorded for the adverse-action notice.
DORA The operations agent tries to change a payments gateway setting. Under DORA, critical system changes need an approver and a record. Agent Authority holds it, and the approval goes into the transcript. That’s the evidence your ICT risk team needs.
The rules written for agents Now regulators are writing guidance for agents themselves. In Brussels, Washington and Hong Kong, they describe the same controls:
- A named owner for every agent.
- Controls tied to what the agent is for.
- A person who approves before high-impact actions run.
- A way to stop the agent.
- A record of every action.
- An inventory of every agent.
Agent Authority does all six today. The manager. The charter. Human authority. The kill switch. The transcript. The inventory.
Everything your employees answer to, your agents now answer to as well. Agent Authority enforces it before the agent acts.
Sources: GDPR Art. 5, 22 and 28; ECOA / Regulation B; DORA (EU 2022/2554); EU AI Act Art. 12, 14 and 26 (high-risk AI systems, from 2 Dec 2027); OCC Bulletin 2026-54; HKMA guidance on agentic AI (Oct and Nov 2026). EU AI Act duties apply to high-risk AI systems. The OCC and HKMA documents are guidance and examiner frameworks, not new binding rules.
