One of the biggest questions that enterprises have been answering is – can we trust what AI produces? However, Optro the AI-powered GRC enterprise believes there is a much harder and pertinent question that organisations now need to answer – how do you govern something that acts? In its recently releases report – ’When AI leaves the chat and enters the workflow’, Optro found while one in three organisations already use AI across critical resilience workflows, they least test for agentic AI failure or loss of control or autonomous decision-making failures.
The report stated 30% have in fact, never tested for it, Guru Sethupathy, GM of AI Governance at Optro said in a press release shared by the company, “The reality today is that agentic AI adoption is fast outpacing governance. But to harness its potential responsibly, leaders must recognise that governance models designed for static manual processes cannot keep pace with autonomous systems of action.”
Sethupathy explained redesigning governance isn’t about pulling back innovation, but it is about building the control structure to give organisations the confidence to scale AI faster and more reliable than then competition.
The company in its press note stated distributed ownership, periodic review cycles, and policy-based controls already strain under supervised AI. These practices are structurally incapable of governing systems acting autonomously at machine speed. The organisations that will gain a competitive edge will be the ones that not only adopt the fastest, but redesign accountability first.
The report said – “Agentic AI is being adopted faster than organisations are redesigning the controls, oversight, and accountability structures needed to govern it. The data tells that story: a widening gap between what leaders believe and what is actually in place.”
Close to 58% of leaders believe their governance controls are keeping pace with AI adoption, however, the report points out a reality gap. It states only 18% have active risk mitigations in place, and the consequences of the distance are already on the record. In the past 12 months, 40% of organisations reported inaccurate AI outputs, 27% reported data breaches, and 26% reported regulatory action tied to AI use.
Regulators have always expected a named, accountable human behind every decision affecting a customer, a market, or a filing. The expectation has not changed. Already, nearly half of security decision-makers name agentic AI as a top security concern. Nearly two-thirds of organizations experienced an AI agent-related incident in the past 12 months, resulting in data exposure, operational disruption, and financial losses.
Autonomous agents authenticate, access systems, and act, which makes them non-human identities. Business units are deploying agents IT does not know exist. While 85 percent of organizations have integrated AI into core operations, only a quarter have comprehensive visibility into how employees are using it.
The report also includes agentic-readiness checklists for internal audit, compliance, IT and cybersecurity, and AI governance teams.
