Your organization probably has an AI policy. Most do at this point.
It covers what data employees can share with ChatGPT, maybe something on approved vendors, possibly a section on bias and accuracy. Legal signed off. The board has seen it. You can pull it up when a regulator asks.
The problem is that policy was written for a different thing.
Most AI policies were drafted when AI meant “ChatGPT in the browser” and the biggest risk was an employee pasting customer PII into a prompt. That’s a real risk. It’s also the manageable one. The harder risk arrived when AI stopped being the thing you query and started being the thing that acts.
AI agents are a different threat category
An AI agent isn’t a chatbot you type into. It’s a process that reads your email, schedules meetings, queries your database, and files tickets without you approving each step. It has credentials. It has access. In most organizations, that access was granted because someone clicked “allow” during setup, without thinking about what they’d just handed over.
The AI governance frameworks that 94% of organizations haven’t updated don’t know what to do with this. They were built to answer: is this AI accurate, is it biased, will it leak data if prompted badly? Those are the wrong questions for an agentic workflow.
The questions that matter now are different. What does this agent have access to? Can it be instructed by someone who shouldn’t be giving it instructions? What happens when it makes a mistake autonomously and nobody’s watching?
The real attack surface isn’t the model
The June 2026 threat reports are full of AI-related CVEs and supply chain attacks targeting AI tooling. Last year alone, 2,130 AI-related CVEs were published, a 34.6% jump year over year. The first high-severity vulnerabilities hit major coding tools and agentic platforms.
That’s real. Most organizations aren’t going to get hit through a zero-day in the model layer, though. They’re going to get hit through the integrations.
Your AI agent has an OAuth token for your SharePoint. Read access to your email. It can create calendar events, open tickets, submit forms. Every one of those connections is an attack surface, and every permission you clicked through is a door you left open.
If a threat actor can prompt-inject that agent, compromise a connected tool, or socially engineer the employee whose credentials the agent uses, the model’s safety guardrails are beside the point. The model doesn’t know it’s being used against you.
What this means for regulated industries
For community banks and financial institutions, this isn’t theoretical.
Federal examiners are already asking about AI governance. Model Risk Management frameworks like SR 11-7 were built for a world where the “model” was a static algorithm in a spreadsheet. Agentic AI breaks those assumptions. The model isn’t static. It takes inputs from the environment, takes actions, and behaves differently depending on what data it’s given.
If you’ve deployed AI tools that access customer records, send communications, or make operational decisions without human review, you have model risk your current MRM framework probably doesn’t cover. That’s the question your board should be asking. Not “do we have an AI policy?” but “does our AI governance cover what our AI is actually doing?”
Those are not the same question.
The fix isn’t another policy
The governance gap isn’t a documentation problem. Writing a new policy for the new thing won’t close it.
The actual work is an audit: what do your AI tools have access to? Get the permissions list. Find the service accounts. Map the integrations. Understand what each agent can do without a human approving the action.
Then ask whether that’s appropriate. Does anyone have visibility when the agent acts? What’s the process when it makes a mistake?
Most organizations don’t have clean answers. The tools got deployed faster than the governance, and the security team found out after the fact. If at all.
The 6% of organizations that updated their governance did something straightforward. They treated AI agents the same way they treat any system with privileged access. Not because AI is magic, but because any process that acts on behalf of your employees and your organization needs the same scrutiny as any other privileged account.
Stop governing the model. Start governing what it can touch.
If you’re not sure what your AI tools have access to, that’s the first thing to figure out. Book a call.
