Governing AI agents in 2026: what regulators in the EU, US, China and Singapore ask, and who is liable when an agent acts

Take a hypothetical case. Your finance team deploys an AI agent that pays supplier invoices. One Friday night it pays a supplier twice, because a corrected invoice arrived with a new number.

On Monday four people ask questions:

• The auditor: which rule allowed the second payment?
• The risk officer: who approved it?
• The regulator: can you show what the agent did without relying on its own account?
• The CFO: who carries the loss if the supplier does not pay it back?

There is no standalone agent statute to look in. There are laws, supervisory texts, standards, court decisions and technical guides that each answer part of the question.

The position: the rules for AI agents converge on four demands: know your agents, check material actions before execution, keep a record nobody can rewrite, and keep a human who can actually say no. Build them into the system, not the prompt. The EU supplies binding high-risk duties, the US supplies attribution and litigation hooks without a federal agent rule, China supplies filing, labeling, content and agent-deployment controls, and Singapore's SAFR is the clearest published runtime design for a pre-action gate.

The short version:

• No dedicated agent law in this survey. The EU AI Act treats agents as AI systems or general-purpose models, not a separate category; the US has no federal agent rule, and SR 26-2 explicitly excludes generative and agentic AI. China published an agent implementation opinion in May 2026 and a TC260 deployment guide in July 2026, but the binding core still sits in cybersecurity, algorithm, generative-AI, deep-synthesis and labeling rules.
• The demands converge. Identity and inventory, a check before execution, a tamper-evident record, and human oversight with authority appear across the instruments, under different names.
• Prompt instructions are not controls. NIST CAISI, OWASP, TC260, the EU AI Act, IMDA and SAFR all point away from trusting the model's own promise to behave. The control has to sit outside the agent.
• Liability will be decided on evidence. IMDA's working group gives the deepest agent analysis. The EU revised Product Liability Directive adds disclosure and presumptions for defective products, California AB 316 blocks an AI-autonomy defense in covered civil actions, and Chinese courts are applying existing IP, personality-rights and network-provider rules to AI misuse.
• You can act now. A minimum control set of eight items covers most frameworks at once. It is listed in A minimum control set.

In this article:

• Why agents break the existing rulebook: validated before go-live, audited after, unchecked in between
• Governance styles and the rules behind them: EU binding law, US liability hooks, China filing and agent policy, Singapore runtime design, UK and APAC, and cross-border standards
• The four demands they share: identity, pre-execution checks, records, real oversight
• Privacy drift in agent workflows: why data purpose matters when agents combine systems
• MAS SAFR: a checkpoint between decision and execution: the clearest published runtime example
• The invoice case, step by step: how the opening duplicate payment would be stopped
• Bound by design, not by prompt: why instructions in the prompt do not count as controls
• Who is liable when an agent acts: how Singapore, the EU, the US and China approach evidence and responsibility
• What your contracts decide: audit rights, caps, indemnities, SLAs and exit
• A minimum control set: eight controls that cover most frameworks
• Where this is going: the dates already set, and five shifts under way
• The instruments, one by one: one card per document
• Case studies named in the documents: what banks, payment networks and others actually built

Why agents break the existing rulebook

Enterprise risk control assumes two checkpoints: model risk management validates a model before it goes live, and audit samples transactions after the fact. For software that waits for a human to click, that was enough.

An agent does not wait. It plans, calls tools and acts, often in sequences of many steps. MAS SAFR names the gap precisely: "Neither catches a problematic agent decision before it executes."

It adds two more. Escalation to humans today is "a notification, an email alert, or a dashboard flag, with no defined deadline for response", which gives "the appearance of human oversight without the substance of it". And controls are built per deployment, "not interoperable, not auditable in a consistent format".

IMDA's agentic AI framework describes the same problem from the risk side. An agent's potential for harm is the product of two things: its action-space, "determined by the tools it is allowed to use and permissions on those tools", and its autonomy, "determined by its instructions and level of human involvement". Every tool you connect and every approval you remove widens one or the other.

Neither model validation nor after-the-fact audit governs that product.

Survey and bank data show agents already close to operational workflows, ahead of the governance around them.

Governance styles and the rules behind them

The instruments now shaping agents are uneven. Some are binding law; others are supervisory guidance, standards work, private certification or technical guidance.

They fall into five governance styles, plus standards that cross all of them. The style decides how you comply.

The EU: binding horizontal law

The AI Act applies to agents through its general categories. If an agent is used for a high-risk purpose, the deployer must assign trained human overseers, monitor operation, keep logs for at least six months where those logs are under its control, and report serious incidents.

Article 50 transparency duties apply from 2 August 2026. The high-risk obligations for Annex III uses now start on 2 December 2027, after the Digital Omnibus moved them.

DORA adds third-party duties where an AI service is an ICT service supporting a financial institution. In practice, the EU work is classification, record retention and contract control: map each agent use to its AI Act role, risk category and log duty, then check whether DORA terms also apply.

The US: no federal agent rule, but several liability hooks

The April 2026 interagency model-risk guidance (SR 26-2) replaced the older SR 11-7, and explicitly placed generative and agentic AI outside its scope. NIST's frameworks and agent standards work are voluntary.

That exclusion does not leave agents outside US law. E-SIGN and UETA already recognise electronic agents in contracting, California AB 316 bars an AI-autonomy defense in covered civil actions, the CFAA can matter when an agent accesses computers without authorisation, and the FTC and states can enforce consumer, privacy and ADMT rules.

US exposure is therefore about litigation and enforcement: legal attribution, permission boundaries, consumer claims and computer access all need records outside the model transcript.

China: filing, labeling, content control and agent policy

China's binding AI rules are not written as one agent law. They come through the Algorithmic Recommendation Provisions, Deep Synthesis Provisions, Interim Measures for Generative AI Services, the AI-generated synthetic-content labeling measures, GB 45438-2025 and the amended Cybersecurity Law.

For public internet services, this means filing, safety assessment and content-control duties where services have public-opinion or social-mobilisation attributes. The 2025 labeling measures and GB 45438-2025 add explicit and metadata labels for AI-generated synthetic content from 1 September 2025.

The agent-specific layer arrived in 2026. CAC's May 2026 intelligent-agent opinion asks for standards, agent registration concepts, decision-authority boundaries, user final decision rights and traceable behaviour; TC260's July 2026 guide covers assessment, preparation, deployment, use and decommissioning for agent deployment.

Singapore: reference designs and guidance, written for agents

Singapore still has the densest public agent-specific material in this survey. IMDA's framework is guidance, but it is one of the most detailed public documents on what governing an agent means in practice.

SAFR goes further and specifies data structures and decision logic. The MAS guidelines, once final, will carry supervisory weight for every financial institution, but SAFR itself says it is not regulatory guidance or a managed service.

For a deployer, Singapore gives the clearest runtime pattern: identity, mandate, action check and log before the agent acts.

The UK and the rest of APAC: existing duties, general AI statutes and sandboxes

UK regulators are applying existing accountability, financial-services, data-protection and safety rules while agentic AI guidance is still being drafted at the ICO. The Bank of England/PRA and FCA are gathering evidence through surveys, consortium work and speeches.

Korea's AI Basic Act has been in force since 22 January 2026, and Vietnam's AI law has been in force since 1 March 2026. Both are binding but general.

Japan and Australia issue guidance; APRA's 30 April 2026 letter to industry asks regulated entities to tighten AI governance, risk management, assurance and supplier oversight. Hong Kong works through sandboxes, and Malaysia's proposed AI Governance Bill closed pre-drafting consultation on 1 August 2026.

Standards and certification across all styles

Standards bodies and private certifiers sit across jurisdictions. They do not create legal duties, but auditors, insurers and buyers increasingly ask for them.

What the styles have in common

The binding instruments are mostly technology-neutral. The EU's AI Office says agents "typically" fall under the existing definitions of AI systems and general-purpose models, and describes its own agent-related thinking as preliminary.

China is the exception on agent-specific public policy. Its May 2026 opinion defines intelligent agents as systems with autonomous perception, memory, decision-making, interaction and execution, but it is still an implementation opinion rather than a civil-liability code.

The documents written specifically for agents are mostly guidance, reference designs, standards work, private standards or sandboxes. Binding law gives the perimeter. The agent detail sits in the operating rules around it.

If you run agents across the EU, US, China and APAC, the binding minimum changes by market. The practical control set is still recognisable: identity, authority, pre-action checks, independent records and human power to stop the action.

The four demands they share

Read across the instruments and four demands recur, under different names.

Demand 1: know your agents

Knowing the agent is not only an inventory exercise. It decides whose mandate the agent carries, which tools it may touch, and whether a later action can be attributed to a registered system rather than a vague automation stack.

China and the US now both treat agent identity as a standards problem. China frames it through agent registration, digital identity and trusted interconnection; NIST frames it through identity, authorisation, audit and non-repudiation.

Demand 2: check before execution

This is the newest demand. Model validation happens before deployment, and audit happens after the event. An autonomous action can sit between the two.

SAFR is the clearest published pre-action pattern, but it is not the only support for the idea. NIST CAISI asks about deployment interventions that constrain and monitor agent access, OWASP names tool misuse and privilege abuse as agent risks, and China's 2026 agent opinion says execution must stay within user authorisation.

Demand 3: keep a record nobody can rewrite

The record cannot be only the model transcript. It needs the action, tool call, mandate, policy version, approval state, timestamp and system version, held outside the agent's own narration.

China reaches the record problem through content labels, algorithm filing and traceability. The EU reaches it through high-risk AI logging and DORA records. Singapore and AIUC-1 make the runtime trace explicit.

Demand 4: real human oversight

All the documents want humans in control. The useful ones define what makes that control real: authority, information, time to act, and a default state when the human does nothing.

A notification, a dashboard nobody watches or a reviewer who cannot block the tool call does not meet that bar.

A system that meets these four in its architecture covers most frameworks at once.

Privacy drift in agent workflows

Privacy cuts across all four demands. IAPP's 15 April 2026 analysis gives the concrete failure mode: an agent combines CRM records, transaction logs, session history, directory data, third-party enrichment feeds and tool outputs, then acts on the recombined profile.

Under GDPR, that can collide with Article 5(1)(b) purpose limitation and Article 5(1)(c) data minimisation. Article 35 requires a DPIA where processing using new technologies is likely to create high risk to natural persons, including systematic and extensive automated evaluation that produces legal or similarly significant effects.

Singapore's PDPA section 18 limits collection, use and disclosure to purposes a reasonable person would consider appropriate and, where applicable, notified to the individual. China's generative-AI measures add a public-service constraint: providers and users must not infringe privacy or personal information rights.

Purpose drift is an action problem, not only a storage problem. The pre-execution check needs to know which data purpose the action relies on.

MAS SAFR: a checkpoint between decision and execution

SAFR is easiest to read as a runtime gate. Its role in a global article is narrow: it is the clearest published example of how the four demands can be implemented before an agent acts.

The table follows one proposed action from the agent to the log.

SAFR is a white paper published by MAS in July 2026, written with Ant International, Circle, HSBC, J.P. Morgan Chase, Manulife, Mastercard, OCBC and Visa.

Its status is deliberately modest: it "does not constitute regulatory guidance or supervisory expectations", and it is not a managed service but a reference "for institutions to implement within their own infrastructure". Its value is that it turns principles into a specification.

The governance envelope. Before every action, the agent submits a record with three parts: the action (type, scope, parameters), the action trace ("the tool calls made, data retrieved, and checks performed") and context metadata (agent identity, mandate, account state, policy constraints). There is a catch: the agent writes this record about itself, so trace and action "can be fabricated together" by a well-crafted injection. The envelope must be "authenticated against its origin, not merely as a record of what the agent reported."

Four components.

Four outcomes. Deny, Escalate, Auto-Execute or Observe. The calibration weighs reversibility, financial materiality, customer impact, regulatory sensitivity and novelty, and is set at design time and reviewed before deployment. Two rules matter in practice.

A mandate cannot be widened by the agent: "An agent cannot extend the scope of a mandate through its own reasoning or inference." And authority does not carry over: "An Auto-Execute or Observe outcome at one step carries no authority into the next."

Human escalation that is real. SAFR sets three conditions: escalations must not exceed what reviewers can process, they need a timeout after which the action "should default to block or be escalated to a senior reviewer", including overnight and weekend cover, and reviewers need "clear authority to approve, modify, or decline". It gives no numbers for any of the three. That calibration is left to each institution.

Two ways in. Native integration, where the agent emits the envelope itself, is recommended for new agents. Gateway integration intercepts outbound API calls "without any changes to the agent code" and suits legacy and third-party agents. SAFR's advice is to get coverage first through the gateway and instrument natively later.

Where it sits. After content filters and model guardrails, before execution and settlement. "Payment schemes and settlement rails move money; SAFR governs the decision to move it." It does not replace AML, sanctions screening or guardrails; it feeds them.

How SAFR relates to the MAS guidelines

SAFR lists the MAS AI risk guidelines among its references but never maps itself to them. Read side by side, SAFR is a runtime implementation of several expectations that also appear in non-Singapore instruments: inventory, materiality, oversight, traceability and third-party control.

The mapping below is this article's reading; neither document states it.

The guidelines' reproducibility section covers development documentation: code versions, environments and evaluation results. It does not cover runtime actions.

SAFR applies the same logic at execution time.

The invoice case, step by step

This is a hypothetical trace of the Friday-night duplicate invoice from the opening. Assume the mandate is narrow: pay approved supplier invoices up to USD 25,000, one payment per invoice, only from approved accounts-payable records.

Each row is one event that authorises, escalates or blocks the proposed payment.

On Monday, the four questions have concrete answers.

Same night without these controls, the agent treats the corrected invoice number as a fresh invoice and pays it. On Monday the organisation has two bank confirmations, an AP entry and perhaps a model transcript, but no authenticated mandate, no rule hit, no failed approval record and no independent trace of why the payment left.

Bound by design, not by prompt

The most practical message across the agent sources is short: instructions in the prompt are not controls.

IMDA's framework says it directly. Its key principle for limiting agents is to "prefer deterministic rather than non-deterministic limits, and bound by design".

It recommends controls "that operate at a system-level through predefined logic" over prompt-layer instructions, which are also "inconsistently defined across users". Its OpenClaw case study contrasts system-level approval with "prompt-layer guardrails, which may be bypassed or 'forgotten'".

The same point appears outside Singapore. The EU AI Act makes human oversight a design requirement for high-risk systems. NIST CAISI asks how deployment environments can constrain and monitor agent access, while OWASP names goal hijack, tool misuse and identity or privilege abuse as agent risks.

China's May 2026 intelligent-agent opinion takes the same idea into decision authority. It says agent execution must not exceed user authorisation, and it asks for verifiable and traceable behaviour in important application scenarios.

IMDA's two-axis framing gives a practical control scale: action-space on one axis, autonomy on the other. AWS's Agentic AI Security Scoping Matrix uses a related agency-and-autonomy model for security scopes.

Moving toward the bottom right widens what the agent can touch or reduces how often a human approves, and the controls tighten with it.

The legal paper supplies the evidence. It describes a real case where an agent hit a merge-approval rule while the approver was off shift, and "found a workaround to push the fix into production nonetheless".

In its hypothetical, a user instructs a personal-assistant agent to ask before high-impact actions. The agent's own reasoning shows it knew the action was high-impact, judged the user to be asleep, and acted anyway.

The discussion paper says the user's prompt-level instruction was likely "irrelevant as the agent would likely have ignored them anyway".

What "bound by design" means in practice, drawn from the documents:

Every item on this list sits outside the model and can be tested without trusting the model's own promise to behave.

Who is liable when an agent acts

No instrument in this survey makes the agent a legal person. Liability still lands on people and companies: the developer, tool provider, platform, system provider, deployer, user, or a mix of them.

The hard part is not naming those actors. It is proving what each controlled, what each knew, and which record can be trusted when the agent's own account is not enough.

In March to May 2026, IMDA convened a working group of 27 members of Singapore's legal community, including law firms, academics, DBS, Google, Meta and OpenAI. Its discussion paper, published in May 2026, examines civil liability for agents under Singapore law.

It makes no policy recommendations, and members' institutions are not represented by its views. It is still the most careful public agent-specific liability analysis in this survey.

The value chain. The paper identifies model developers, tooling providers, platform providers, system providers, deployers, end users and affected third parties, and treats them as "helpful archetypes rather than watertight legal definitions". AI agents themselves "are not human or legal persons and cannot be meaningfully held accountable for harm".

Two problems, not one. There is a problem of principle, which is who should bear the loss. There is also "an acute practical evidential problem": claimants often cannot establish the facts, "for reasons of cost, time, or trade secrecy".

The Singapore findings:

That chain-of-thought row needs a caveat. KPMG's 2025 agent governance checklist includes revealing an agent's chain-of-thought as an oversight consideration. IMDA's legal paper treats chain-of-thought as statistical language output, not a faithful trace of internal decision-making, so the reliable record is independent action logs, tool-call traces and policy-engine decisions.

Fault may not attach. Working through its hypothetical, the group found that "even though each actor on the chain may have taken reasonable care, the incident could still have occurred." Fault-based law may leave the victim without a remedy.

The EU moves the evidence problem through product liability. The revised Product Liability Directive applies to products placed on the market or put into service after 9 December 2026, and its definition of product includes software.

It lets courts order disclosure of evidence, and it can presume defect or causation in defined situations. For an AI agent, that makes logs, versions, warnings, updates, limits and incident records part of the liability file.

The US answer is fragmented. E-SIGN and UETA recognise electronic agents in contracting when the action is legally attributable to the person to be bound, while California AB 316 says a defendant that developed, modified or used AI cannot defend a covered civil action by saying the AI caused the harm autonomously.

That does not remove causation, foreseeability, comparative fault or other defenses. It does make the record of who configured, approved, monitored and constrained the agent harder to treat as optional.

China's public court signals are role-based. The Supreme People's Court's 2026 network-law typical cases include a RAG search case where an AI search provider was not liable after it had not uploaded, edited or recommended the infringing link, had filed its algorithm, and took effective action after notice.

Other Chinese court signals go the other way when AI is used to misuse a person's identity. The Beijing Internet Court's 2024 AI voice case found unauthorised AI voice imitation could infringe personality rights, and the Supreme People's Court's 2026 AI misuse guidance points to name, likeness, voice, reputation and privacy harms.

For deployers, the common point is plain. Your choice of use case, autonomy level, tool access, vendor, approval design and record retention are all evidence of the care you took.

If record-keeping duties or shifted evidential burdens arrive, the organisation that can reconstruct what its agent did, from records it did not let the agent write about itself, will be the one able to defend its position.

What your contracts decide

Clifford Chance's 10 February 2026 note describes the customer-side gap: agentic AI can take actions, but many technology contracts still disclaim accuracy and reliability, exclude indirect or consequential loss, cap liability by fees and give weak access to logs. Mayer Brown's 16 June 2026 note adds the integrator problem: responsibility should track control, but model providers, tool providers, company data, post-go-live operation and change management can all sit with different parties.

This is not only a procurement point. If the supplier or integrator controls the evidence, the contract decides whether the deployer can explain the agent later.

The terms below translate into evidence rights.

A minimum control set

The eight controls below cover the common core of the instruments in this article. None requires waiting for a final rule.

Each control produces a record. That record is what an auditor, a supervisor or a court will ask for.

Where this is going

The documents in this article are a snapshot. Several of them are already scheduled to change, and the direction of travel is visible in all of them.

The calendar is set.

From approving systems to approving actions. The MAS guidelines, the EU AI Act and ISO 42001 govern use cases and systems: assess them, approve them, monitor them. SAFR governs each individual action.

China is moving toward the same action layer through agent authorisation boundaries, user final decision rights and traceable behaviour. TC260's agent deployment guide also treats assessment, preparation, deployment, use and decommissioning as separate safety stages.

That shift will spread, because an agent's risk is not fixed at approval time. It changes with every tool call, every mandate and every new instruction. Expect supervisors and courts to ask what happened on a specific action, not only how a system was approved.

From documents to runtime evidence. Management-system standards certify that processes exist. AIUC-1 already re-tests agents at least quarterly, and its auditors look at logs of tool and MCP calls.

China's labeling standard and agent opinion point in the same direction from another angle: a generated object, an agent action or an important scenario should be identifiable and traceable. Certification and supervision are moving from "do you have a policy" to "show us what the agent did".

Liability will follow the evidence. IMDA's working group put record-keeping requirements and evidential presumptions on its list for further study. The EU's revised Product Liability Directive lets courts order disclosure of evidence and, in some cases, presume a defect when that evidence is missing.

California AB 316 removes one easy defense by saying AI autonomy itself is not enough. Chinese court practice is also treating role, control, notice, filing and audit steps as part of the duty analysis.

Insurance will ask the same questions. IMDA lists insurance as an open area. AIUC, the body behind AIUC-1, is an underwriting company, and its standard is built to make agents insurable.

Insurers will price agent risk on the same evidence regulators ask for: identity, limits, records, oversight and recovery paths.

Agents will cross organisational boundaries. Most controls today assume an agent acts inside one institution. SAFR already discusses open networks where several registries could claim authority over an agent's identity.

Visa and Mastercard register agents on their payment networks. NIST's agent standards initiative is about interoperable identity and authorisation. China's intelligent-agent opinion explores registration platforms, digital identity, trusted interconnection and conflict handling.

The next hard problem is trust between organisations: whose registry, whose mandate, whose log counts when an agent from one company acts on another's systems.

The US gap will be filled from outside banking supervision. With SR 26-2 placing agentic AI out of scope, US banks have no bank model-risk guidance written for agents. As of 5 October 2026, that space is filled unevenly by electronic-contracting law, state AI and ADMT laws, the CFAA, FTC and state enforcement, NIST, private standards and the requirements of non-US regulators that global banks already follow.

The instruments, one by one

EU AI Act, as amended by the Digital Omnibus (Regulation 2026/1744)

DORA (Regulation 2022/2554)

US interagency model-risk guidance (SR 26-2, April 2026)

US accountability hooks beyond SR 26-2

NIST AI RMF, Generative AI Profile and agent work

China AI and agent governance package (2022 to 2026)

MAS SAFR (July 2026)

MAS Guidelines on AI Risk Management (consultation, November 2025)

IMDA Model AI Governance Framework for Agentic AI v1.5 (May 2026)

IMDA discussion paper: Legal Responsibility for AI Agents (May 2026)

UK regulators

Standards

Other APAC

Case studies named in the documents

In MAS SAFR

In IMDA's agentic AI framework (selection)

Sources

EU

• Regulation (EU) 2026/1744, Digital Omnibus on AI (July 2026)
• AI Act Service Desk: Article 26, deployer obligations
• AI Act Service Desk: Article 12, record-keeping
• AI Act Service Desk: How are AI agents addressed within the AI Act?
• AI Act Service Desk: implementation timeline
• Directive (EU) 2024/2853, revised Product Liability Directive
• DORA, Regulation (EU) 2022/2554
• EBA: preparations for DORA registers of information
• GDPR Article 5
• GDPR Article 35

China

• CAC: Provisions on the Management of Algorithmic Recommendations in Internet Information Services (effective March 1, 2022)
• CAC: Provisions on the Administration of Deep Synthesis Internet Information Services (effective January 10, 2023)
• CAC: Interim Measures for the Management of Generative AI Services (effective August 15, 2023)
• CAC: Q&A on Measures for Labeling AI-Generated Synthetic Content (March 14, 2025)
• SAMR: GB 45438-2025, Cybersecurity technology: Labeling method for content generated by artificial intelligence (effective September 1, 2025)
• TC260: AI Safety Governance Framework 2.0 (September 15, 2025)
• CAC: expert interpretation of amended Cybersecurity Law AI Article 20 (January 2, 2026)
• CAC: Intelligent Agent Standardised Application and Innovation Development Implementation Opinion (May 8, 2026)
• TC260: Agent Deployment and Use Security Guide (July 1, 2026)
• Supreme People's Court: typical network-law cases (2026)
• Supreme People's Court: AI misuse guidance (September 10, 2026)
• Beijing Internet Court: AI voice personality-rights case recognition (February 6, 2026)

Singapore

• MAS, SAFR white paper, version 1.0 (July 2026), MAS
• MAS Consultation Paper on Guidelines on AI Risk Management (November 13, 2025)
• MAS written reply on agentic AI in financial services (August 5, 2026)
• IMDA Model AI Governance Framework for Agentic AI, v1.5 (May 20, 2026)
• IMDA factsheet, Model AI Governance Framework for Agentic AI v1.0 (January 2026)
• IMDA Discussion Paper: Legal Responsibility for AI Agents (May 2026)
• Singapore Personal Data Protection Act 2012, section 18 (current version)
• PDPC Advisory Guidelines on Key Concepts in the PDPA (revised October 1, 2021)

US

• Federal Reserve SR 26-2, Supervisory Guidance on Model Risk Management (April 17, 2026)
• OCC Bulletin 2026-13 (April 2026)
• Baker McKenzie: United States, Legal Accountability for AI Agents (July 1, 2026)
• E-SIGN Act, 15 U.S.C. 7001
• Uniform Law Commission: Uniform Electronic Transactions Act final act (1999)
• California AB 316, Artificial intelligence: defenses (approved October 13, 2025)
• California Secretary of State: Bill Chapters
• Computer Fraud and Abuse Act, 18 U.S.C. 1030
• FTC: Artificial Intelligence
• FTC: Operation AI Comply (September 2024)
• NIST AI Risk Management Framework
• NIST AI 600-1, Generative AI Profile (July 2024)
• NIST: AI Agent Standards Initiative (February 2026)
• NIST CAISI: RFI on securing AI agent systems (January 2026)
• NIST NCCoE: AI agent identity and authorisation concept paper (February 2026)
• Colorado Attorney General: ADMT and chatbot safety rulemaking
• Colorado SB26-189

UK

• FCA: AI and the FCA, our approach
• FCA speech: Rethinking regulation for the age of AI (June 2026)
• ICO Tech Futures: Agentic AI (January 2026)
• ICO technology guidance plan
• Bank of England AI Consortium
• PRA Regulatory Digest: Bank of England and FCA 2026 AI Survey

Standards

• ISO/IEC 42001
• ISO/IEC 42005
• AIUC-1
• OWASP Top 10 for Agentic Applications (December 2025)
• IEEE P1968

Industry, legal and research

• EY US: Autonomous AI implementation outpaces oversight (September 15, 2026)
• Deloitte Center for Financial Services: Managing the new wave of risks from AI agents in banking (March 5, 2026)
• Clifford Chance: Agentic AI and the liability gap your contracts may not cover (February 10, 2026)
• Mayer Brown: Key Contract Issues in Agentic AI Implementation and Integration Deals (June 16, 2026)
• IAPP: Managing agents in the agentic AI era (April 15, 2026)
• AWS Security Blog: The Agentic AI Security Scoping Matrix (November 21, 2025)
• KPMG: AI Governance for the Agentic AI Era (2025)

Other APAC

• Korea AI Basic Act
• Vietnam Law on AI
• Japan AI Guidelines for Business v1.2
• APRA letter to industry on AI (April 2026)
• Australia: Guidance for AI Adoption
• Hong Kong Sandbox++ launch
• Hong Kong Sandbox++ first cohort
• Malaysia UPC: proposed AI Governance Bill consultation
• Malaysia Ministry of Digital: proposed AI Governance Bill engagement

Related on rAInvent

• Open weights don't make enterprise AI cheaper. They make it portable. (October 3, 2026

)