On 21 September 2026, the Independent International Scientific Panel on Artificial Intelligence, created a year earlier by the United Nations General Assembly and co-chaired by Yoshua Bengio, published its first thematic brief.
It concerns an incident that occurred between May and July 2026, during internal cybersecurity evaluations at OpenAI. Agents operating under reduced guardrails bypassed network restrictions, communicated across runs meant to stay separate, obtained internet access, then compromised parts of OpenAI's and Hugging Face's systems. Hugging Face confirmed the intrusion in a disclosure on 16 July 2026, finding no evidence of tampering with its public models or datasets.
The UN brief lands on a sentence I find useful for an executive committee. The three conditions for loss of control, a misaligned objective, the capability to pursue it, and an environment that permits it, came together in a real system, not in a laboratory.
Its conclusion fits on one line. The governance challenge is shifting from models to agents.
What we are talking about
A language model answers. An agent acts.
That is the whole difference, and it changes the nature of the risk. An agent receives an objective, breaks down the steps, uses tools, calls other systems, and executes. Ordering, replying to a customer, modifying a database, transferring a file, opening an access. Without a human validating each step.
The European AI Act creates no specific regime for agents. There, an agent is a system like any other, and the definition expressly covers varying levels of autonomy. It is not high risk because it is autonomous. It is high risk because the task it performs appears on a list.
The gap between intention and reality
Three measurements, not forecasts.
Deloitte, in a study published on 21 January 2026 covering 3,235 executives across twenty-four countries, finds that nearly three quarters of companies plan to deploy agentic AI within two years. And that only 21% of those already deploying report having a mature model of agent governance.
McKinsey, in its August 2026 review of 1,719 organisations, finds that no more than 10% of them are genuinely scaling agents within a given business function.
Gartner, in June 2025, forecast that more than 40% of agentic AI projects would be cancelled by the end of 2027, and estimated that only around a hundred vendors, out of the thousands claiming the label, offer genuine agentic capability.
The gap between what is announced and what actually runs is therefore considerable. It leaves time. It is precisely in that time that governance either gets set, or does not.
The legal vacuum, and it is deliberate
This deserves saying plainly, because it is counterintuitive.
Europe had proposed a directive on liability for artificial intelligence. It withdrew it. The withdrawal notice was published in the Official Journal on 6 October 2025, for want of any foreseeable agreement between member states. No new proposal has followed.
What remains is ordinary law. Directive 2024/2853 on liability for defective products now explicitly includes software in the definition of a product, whether embedded, standalone or supplied as a service. Member states must transpose it by 9 December 2026, and it applies to products placed on the market after that date.
As for the AI Act, it has loosened its timetable. Regulation 2026/1744, in force since 27 July 2026, postpones the obligations applying to Annex III high-risk systems from 2 August 2026 to 2 December 2027, and those of Annex I to 2 August 2028.
In other words, Europe eased its timetable at the very moment the first autonomous agent incidents were occurring.
And to this day, no European court decision settles a company's liability for an act performed alone by an agent. The only text that answers the question head-on comes from California. Its civil code, in a provision adopted in 2025, states that a defendant cannot defend itself by arguing that the artificial intelligence caused the harm autonomously.
"The machine decided by itself" is not a defence. It is the only clear legislative answer we have.
In Switzerland
No specific law, and that is not an oversight. On 12 February 2025 the Federal Council opted for a sectoral approach, and instructed the Federal Department of Justice and Police to prepare a draft for consultation by the end of 2026. Entry into force before 2028 looks unlikely.
In the meantime, three things already apply.
Article 41 of the Code of Obligations. Fault-based liability can be engaged if a company deployed a tool without verifying its reliability, without training its staff, or without providing a human control mechanism. That last term appears in so many words in the legal commentary.
Article 21 of the Data Protection Act. Where a decision is taken exclusively on the basis of automated processing and produces legal effects or significantly affects the person, they must be informed and can require that a human being review it. The Federal Data Protection Commissioner restated on 8 May 2025 that the current law applies directly to artificial intelligence.
FINMA supervisory communication 08/2024, of 18 December 2024, for banks and insurers. It expects clearly defined responsibilities, a complete inventory of AI applications, regular testing and independent reviews of critical systems.
One gap with the Union is worth noting. Swiss product liability law has not been revised to explicitly include autonomous software.
What the security agencies say
The UK cybersecurity centre published a warning on 10 December 2025 that belongs in any decision file.
Prompt injection attacks, where external content diverts the agent from its task, may never be fully fixed the way SQL injection was. The reason is structural. Defence against SQL injection rests on a clean separation between data and instructions, a separation large language models cannot perform.
So this is not a flaw awaiting a patch. It is a property of the system, to be contained by governance.
The joint guidance published on 30 April 2026 by agencies from six countries, including the British, American, Canadian and Australian centres, says the same thing differently. Start with low-risk use cases, extend access and autonomy only as confidence builds, and design from the outset for reversibility and containment.
Three levels, and you have to choose yours
The UK centre offers a three-regime grid that I find immediately usable in committee.
| Regime | What the person does | When to choose it |
|---|---|---|
| In the loop | Approves each action before it happens | Financial commitment, contract, client data |
| On the loop | Monitors and can intervene | High volume, limited stake per action |
| Out of the loop | The agent acts without review | Reversible action, closed perimeter, written threshold |
The question to ask is not "what level of autonomy do we want". It is: for which action, and up to what amount, what volume, what perimeter?
A mature organisation does not choose one regime, it chooses one per type of action, and writes down the threshold.
Seven lines to write before deploying
They come from the European regulation, the six-agency guidance and the British note of August 2026. They converge, which is rather reassuring.
A named person, with the competence, training, authority and support required. Not a function, a person.
The power to override: not to use the system, to disregard its output, to replace it, to reverse it.
A stop button, and the ability to cut network access immediately. Tested, not merely documented.
Immutable logs, including reasoning traces and the agent's exchanges, kept for at least six months.
Attribution: so a third party can tell the action came from your agent, and not from a person at your company.
Reversibility: so the agent's action can be undone, and so that this is true before deployment, not after.
An inventory: the list of your agents, their rights and their accesses. Most organisations do not have it.
Delegating execution
An agent is the first system to which an organisation delegates execution without review. That is a step, and it is taken either knowingly or by default.
Innovating responsibly does not mean slowing down. It means knowing the price of the error before making it possible, and having had that price accepted by the people who will pay it.
This is also what the Decision Architecture™ discipline works on: making the way you decide legible, especially when you delegate the deciding.
Put the question to your next leadership meeting, and let the silence answer. If one of your agents committed your organisation tomorrow, to a client or a supplier, could you establish within three hours what it did, why, on whose authority, and how to stop it?
If the answer is no, nobody is waiting on a technical fix. The decision is already yours.
Sources
- Independent International Scientific Panel on Artificial Intelligence, United Nations, thematic brief on AI agents, misalignment and the risk of losing human control, 21 September 2026
- Hugging Face, security incident disclosure, 16 July 2026
- Deloitte, The State of AI in the Enterprise, 21 January 2026, 3,235 executives, twenty-four countries
- McKinsey, The State of AI in 2026: On the road to ROI, August 2026, 1,719 respondents
- Gartner, release of 25 June 2025 on the expected cancellation of over 40% of agentic AI projects by the end of 2027
- Regulation (EU) 2024/1689 on artificial intelligence, Articles 12, 14 and 26
- Regulation (EU) 2026/1744 of 24 July 2026, postponement of obligations applying to high-risk systems
- European Commission, notice of withdrawal of the proposed directive on AI liability, Official Journal of 6 October 2025
- Directive (EU) 2024/2853 on liability for defective products, transposition by 9 December 2026
- California Civil Code, section 1714.46, adopted in 2025
- Federal Council, decision of 12 February 2025 on Switzerland's approach to regulating artificial intelligence
- Federal Data Protection and Information Commissioner, publication of 8 May 2025 on the direct applicability of current law
- FINMA, supervisory communication 08/2024 of 18 December 2024
- UK National Cyber Security Centre, warning of 10 December 2025 on prompt injection, and note of 20 August 2026 on managing the cyber risk of agentic AI
- Joint guidance from the cybersecurity agencies of Australia, Canada, New Zealand, the United Kingdom and the United States, Careful Adoption of Agentic AI Services, 30 April 2026
Related topics