Companies adopting agentic AI risk choosing easier-to-approve tools over more capable ones: Report

Companies adopting agentic AI risk choosing tools that are easier to get through cybersecurity and procurement approvals over those that can perform the required tasks better, making ease of approval a potential priority over actual capability, according to a report by the Actuaries Institute.

Companies adopting agentic AI risk choosing tools that are easier to get through cybersecurity and procurement approvals over those that can perform the required tasks better, making ease of approval a potential priority over actual capability, according to a report by the Actuaries Institute. The report noted that the deeper commercial risk is not vendor lock-in, although that remains a concern as integrations and organisational dependence increase over time.

“It is the risk that procurement decisions prioritise ease of approval over capability: choosing the agent that clears CISO (cybersecurity team) and procurement review most smoothly over the one that does the agentic work best.” A pre-packaged agent that slots into the existing compliance posture is attractive precisely because it generates no friction, while the more capable agent may demand new controls, a harder security review and unfamiliar vendor terms.

However, the report cautioned that a pre-packaged agent may lack the capabilities required to perform a particular task to the necessary standard, a fundamental limitation that cannot be addressed simply by adding more controls. “The objective is not to select the system that is easiest to govern. It is to select the system that best meets the business need and implement governance arrangements proportionate to the risks it creates,” it said.

Accordingly, AI controls should be selected and calibrated based on the specific use case, the risks it creates and the organisation’s risk appetite, rather than being applied uniformly across all deployments. The report also stressed the importance of monitoring technical failures and customer complaints to identify AI-related risks early and enable corrective action. For instance, claims wrongly rejected by an AI system and later overturned could signal problems with the model’s performance, while customer documents containing information from another person’s claim could point to cybersecurity or data privacy risks.

At the same time, it said, “Human review of every interaction would defeat the purpose, since the agent exists to handle volume across channels.” Instead, internal and external dispute resolution mechanisms need to be easily accessible, timely and effective, as AI agents operating at scale could generate a large number of disputes when errors occur. As automation increases the volume of interactions, even a relatively stable error rate could translate into a higher absolute number of errors.

“Quality assurance arrangements built for human-scale volumes may be inadequate. As throughput increases significantly, organisations should strengthen (not just scale) quality assurance, monitoring and statistical process controls,” it said. (ANI)