Here's a test. Pick any automated decision your business made last Tuesday. A claim routed. A payment released. A customer record changed.
Now show me, in under an hour, what information that decision was based on, which rule allowed it, who owns that rule, and whether a person was supposed to check it.
If a person made the decision, you can probably do it. There'll be an email, a note on the file, a name against the transaction.
If software made it, most businesses can't. And that is the single biggest reason agents are stuck in pilot in regulated industries.
The audit trail you didn't know you had
Manual processes are slow and expensive, but they have one feature nobody appreciates until it's gone. They leave evidence behind without anyone trying.
Sarah in claims approved it. Her name is on it. She followed the procedure, and the procedure has an owner. If the regulator, the auditor or the customer's solicitor asks what happened, you can answer.
Replace Sarah with an agent and that evidence stops being produced unless you deliberately design it in. The agent read six documents, called two systems, weighed one thing against another and took an action. Where is that written down? In most deployments I see, the honest answer is a log file that nobody in risk could read and nobody in IT could map to a policy.
The agent may well have made the right call. You just can't prove it. In a regulated business, a decision you can't prove is a liability, however good it was.
Regulators have already noticed
This is moving from good practice to expectation.
Singapore published the first government framework written specifically for agentic AI in January 2026. Its four themes work well as a checklist: bound the risks up front, make humans meaningfully accountable, apply technical controls across the agent's whole life, and make sure the people using it know what it can and can't do.
In Europe, the AI Act already sets human oversight and record-keeping duties for high-risk systems. The Digital Omnibus has moved the main deadline for stand-alone high-risk systems to 2 December 2027, but the duties themselves haven't gone anywhere.
Different jurisdictions, same direction. If an agent acts, someone has to be able to show what it did and who was answerable for it.
What good looks like
When ETT deploys an agent, the output isn't only the completed task. Every action also produces a record that answers five questions.
- What did the agent see? The inputs, as they were at that moment.
- What did it decide, and what were the alternatives?
- Which policy or rule permitted that decision?
- Who owns that rule, by name or role?
- Was a human checkpoint required, and if so, who cleared it and when?
We call that the Evidence File. It's written for a compliance officer to read, not an engineer. It's produced at the moment of the action, not reconstructed afterwards.
It sounds like overhead. In practice it's the thing that gets the project signed off. When the head of risk can open a file and see exactly what happened last Tuesday, the conversation changes from whether to allow this to where to use it next.
The practical upshot
If you're evaluating an agent platform or a partner, ask to see the evidence output before you see the demo. If it doesn't exist, or it's a raw log, you know where your project is going to stall. Better to find that out in week one than month nine.
Sources: IMDA Model AI Governance Framework for Agentic AI, via Baker McKenzie, January 2026 · Gibson Dunn on the AI Act Omnibus dates · Hunton on the Omnibus entering into force