AI Governance
Data Centers
Drones
Climate
Privacy
2026 Maine Senate
Bob Dylan
Agent Oversight Still Needs Clear Duties and Tested Controls
The EU AI Office’s inquiry into reported agent incidents keeps a consequential question open: how far do AI Act safeguards reach into model development and testing? Yesterday’s reporting also detailed ServiceNow’s proposed controls for agents that exceed their permissions. Both developments continue earlier coverage; neither establishes a new enforcement outcome or proven operational safeguard.
The EU inquiry remains the more consequential development. The AI Office has requested information on security, external evaluations and monitoring following reported incidents involving OpenAI and Anthropic. The Commission is examining whether risk-mitigation duties apply before EU market entry despite the research and testing exemption. That question, first covered in the October 15 briefing, remains unresolved. No infringement, corrective measure or penalty has been announced.
BigGo Finance’s October 17 report adds implementation detail to ServiceNow’s October 15 AI Passport announcement. The proposed system uses signed credentials to check agent permissions during execution and can restrict or halt agents that exceed approved boundaries. General availability remains planned for Q4 2026. This is further reporting on an announced capability—not evidence of deployment, adoption or independently tested effectiveness.
Key Points
- The two developments address different boundaries: when legal duties attach, and what agents may do while running. Their overlap makes agent control a concrete governance question, but does not establish a shared standard or an effective oversight regime.
Implications
For legal and procurement teams, three judgments need to stay separate: whether an obligation applies, whether a supplier offers a relevant control, and whether that control works. An unresolved inquiry cannot establish a new duty; a product announcement cannot demonstrate compliance or containment.
Watchpoints
Watch
Whether the Commission clarifies the development and testing exemption or issues formal findings or corrective requirements arising from the reported incidents.
Watch
Whether AI Passport reaches general availability as planned, which integrations it supports, and whether independent testing shows that its authorization controls withstand attempts to exceed approved boundaries.
Fallout
The practical questions remain legal scope and operational validation, rather than newly established obligations or demonstrated control performance.
AI Act Duties During Development and Testing
The inquiry could clarify where exempt research ends and enforceable frontier-model safeguards begin.
Fresh developments
The inquiry remained relevant without an established procedural escalation. Information requests concern provider security, external evaluations and monitoring after reported agent incidents.
Why we noticed
The outcome could affect testing controls, incident records and regulatory engagement before models enter the EU market. Available reporting does not establish the Commission’s eventual interpretation.
Watch for:
- A formal interpretation of the research and testing exemption.
- Findings or corrective requirements that specify providers’ responsibilities.
Runtime Authorization for Enterprise Agents
ServiceNow’s offering targets permission enforcement during execution, rather than relying solely on written policies and prior approvals.
Fresh developments
BigGo Finance described AI Passport’s announced signed-credential controls, with NVIDIA as design and launch partner. Planned Q4 2026 availability is unchanged.
Why we noticed
The proposed mechanism gives enterprise buyers something concrete to evaluate. The single secondary report does not establish customer deployment or effective enforcement.
Watch for:
- Confirmed availability and supported integrations.
- Independent evidence of how the controls handle out-of-scope agent actions.
Final Thought
Agent governance is becoming more concrete about the boundaries it must enforce. What remains unfinished is establishing which boundaries the law requires—and showing that operational controls can reliably hold them.