Companies should make sure their AI policies address agentic AI, not just the now-familiar generative AI. While generative AI creates content in response to a prompt, agentic AI can plan and take steps on its own to reach a goal provided by the end user. Thus, it may search company records, update accounts, make payments, schedule appointments, or use multiple business systems. In short, agentic AI can act for the company, not simply give it information.

That ability creates greater potential efficiencies and greater risk. An incorrect answer from generative AI may be caught before anyone uses it. However, an agentic agent’s mistake may cause a payment, disclosure, message, or system change before a person can step in. Agentic AI may also have broad access to sensitive data and outside applications. This can increase privacy, security, compliance, contract, recordkeeping, and accountability risks.

Companies should manage agentic AI based on what it can do and the harm it could cause. They should limit the data, systems, and actions available to each agent and require human approval for important decisions. Companies should also test and monitor agents, keep clear records of their actions, prepare for failures, and require vendors to meet security, data-use, audit, and liability standards. Agentic AI should be governed as authority given to a system, not as a more comprehensive chatbot.

If you would like assistance with reviewing and revising your AI policies, reach out to Nicholas Berenato at CODISCOVR. At CODISCOVR we deliver client-focused, defensible solutions that are tailored to each organization’s specific needs. Nick is an attorney that collaborates with clients to address legal and financial exposure from their information assets through information governance. He develops strategies and policies to enable clients to effectively manage their data in a manner that minimizes costs and allows clients to leverage their data to support their business processes.