Cyber Reporting Deadlines Put Pressure On Businesses To Trace AI Agent Actions

AI agents can take unexpected routes to complete tasks, leaving businesses unable to explain exactly what happened when something goes wrong, especially in a cybersecurity investigation. This uncertainty becomes a compliance problem when regulators require companies to report security incidents within strict deadlines. For CIOs and CISOs, the challenge is shifting from approving AI deployments to proving they can govern them and adhere to the latest compliance guidelines.

Simon Gooch, Field CIO at Saviynt, has seen companies make similar mistakes with compliance before. He spent more than 25 years at Accenture, leading cloud transformation, security, and digital identity initiatives. He worries companies are giving AI agents access to important systems before establishing the controls needed to manage them. “To some degree, up to this point, the guardrails, the considerations of the impact, and the governance of all that technology have been secondary,” he says.

AI adoption is exposing a familiar governance blind spot

Gooch thinks companies often view compliance as an afterthought when adopting new technology. He recalls how some organizations approached GDPR. They focused on what they could legally defend and how much time they could buy to change their processes. "How do we argue our position legally? And if that doesn't work, how do we give ourselves enough time to adjust whatever process we need to adjust to be roughly compliant?" he says.

As a reference, Gooch remembers the migration from on-premises to cloud computing. Employees could use services even before companies knew who was accessing them, how much they cost, or what risks they posed. AI adoption is following a similar trend. New rules now focus on product security, AI risk, and supplier accountability. 

"There's a big coming together of some of these different regulations. I think they're forcing organizations to really start asking: where are we from a governance perspective?" Gooch says. He thinks pressure will make it harder for companies to use technology first and manage its governance later.

New cyber rules put AI's accountability gap on the clock

The EU's Cyber Resilience Act makes the problem immediate for manufacturers of covered digital products. Since September 2026, they must give an early warning within 24 hours of discovering a serious vulnerability or security incident. A detailed notification follows within 72 hours. "How are you going to report and understand the breach, or all the information you need to report, within your 24-hour window when you don't necessarily understand in detail what your machine is doing?" Gooch asks.

The initial warning doesn’t require a full investigation. Organizations must collect enough information to find affected products and establish initial facts. Starting in December 2027, other CRA requirements will add more responsibilities for managing third-party components and vulnerabilities during a product's support period.

The EU AI Act sets risk-based rules. These include documentation, logging, and human oversight for high-risk systems. More requirements will take effect in 2027 and 2028. The UK's proposed Cyber Security and Resilience Bill aims to extend security and reporting duties. This will affect more critical service providers and suppliers.

Gooch notes that these laws differ, but they all need clearer responsibility for connected technologies."It's making everyone understand accountability all the way up and down the chain," he says of the CRA.

The next compliance check starts when an AI agent is built

Gooch argues that organizations must establish controls during AI development. He compares this to software development, where teams set up CI/CD pipelines as they began releasing software faster. These checks helped teams find and fix problems before the software went live. "We understood that as a governance approach: build the controls required for compliance as early as possible in the lifecycle of whatever you're doing," he says.

He believes the same approach should apply to AI agents. Organizations need to know which models are being used, where they came from, what data they handle, and what permissions they have. They also need records that help investigators reconstruct unexpected actions, with controls suited to the system's risks and applicable regulations.

"If you're developing AI agents in your organization, you need to think about controls at the point those things are created," Gooch says, "If you wait until they've been rolled out to check whether you're compliant, particularly now that compliance itself is being looked at differently, it's too late." But documenting an agent's behavior only addresses part of the problem. Companies also need to establish who is responsible for the actions that agent takes.

Autonomous agents still need someone accountable for their actions

Gooch argues organizations should view AI agents as separate entities. They need clear ownership and control over what these agents can access and do. "If you don't treat them as first-class citizens, almost like another identity type, and put governance around them, you run into problems," Gooch says. 

As agents take on more duties, companies must track who gave access. They also need to know who is accountable when issues arise. "There needs to be accountability for the AI agent," Gooch adds. He believes organizations can’t avoid responsibility just because a decision came from an autonomous system.

That responsibility also changes how companies should approach compliance. Gooch believes the new regulations can help businesses build stronger controls early. This way, they can understand AI risks more clearly and feel more confident using autonomous systems. The goal is to make governance useful throughout an agent's lifecycle. "It has to be about building a system of control that enables you to use this technology effectively while remaining compliant," he says.