Documentation doesn’t tell us what an AI system is doing today
In the article “AI Governance Needs More Than Policies,” Gartner highlights precisely this problem. Policies and training sessions establish intentions, but they do not guarantee that an AI system will adhere to those intentions during live interactions. And it is precisely when the system is running in production that risks arise which a document cannot capture: a model that no longer performs as originally intended, output that turns out to be biased or factually incorrect, or data that ends up somewhere it shouldn’t be through an unintended path.
These aren’t one-time risks that you can simply check off the list when the model goes live, but risks that can arise anew every day, depending on the context in which the system operates.
As AI systems become increasingly intertwined with business processes, SaaS platforms, and—ever more frequently—autonomous agents, that context also grows larger and less manageable. Many organizations still rely primarily on documentation, training, and a phased rollout to manage AI risk. While these remain important, they do not provide continuous verification or enforcement during actual use.
The gap between what governance aims to achieve and what happens in practice therefore grows as systems scale up. Gartner sees the solution in the continuous monitoring of AI so that organizations can detect deviations, enforce controls, and remain compliant while the system is running—rather than just on paper.
The blind spot of AI agents
AI agents make this issue even more urgent. Whereas a model typically follows a fixed path from dataset to validation to production, agents emerge outside that process: a developer can connect an agent to a tool, a dataset, or another system in a single afternoon, and from that moment on, that agent performs actions independently. No one in the governance department needs to know about this, let alone what the agent is doing exactly, what data it is accessing, or on whose behalf it is acting.
Multiply that across dozens of teams, and the scale becomes clear: estimates suggest there will be more than a billion autonomous agents active in cloud environments by 2028. Spreadsheets, standalone registration forms, and periodic surveys of teams cannot keep up with that pace, resulting in incomplete AI registries, missing audit trails, and agents operating completely outside of any oversight.
Under the EU AI Act, which applies to all AI systems operating in Europe, agents are not considered exceptions but rather part of those systems. Therefore, they must also comply with this legislation. The EU AI Act Hub keeps these obligations up to date, and with the self-assessment tool, you can determine in just a few minutes where your system falls within the risk classification and which requirements apply.
The risk of working without a governance platform
By continuing to rely solely on documents as the basis for oversight and control of AI systems and agents, a gap is created that keeps growing, along with the associated increasing risks.
Gathering evidence for an audit becomes virtually impossible; due to manual processes, compliance becomes a bottleneck for launching and scaling AI; and agents are built throughout the organization with unsupervised access to data.
An AI governance platform like Deeploy can provide a solution to this. In line with Gartner’s vision, a platform enables continuous registration and monitoring of all AI systems within the organization, including agents. This ensures that AI systems perform as intended and that you are immediately notified when they do not. By applying specific frameworks to AI systems, a major step can simultaneously be taken toward compliance with regulations such as the EU AI Act.
→ Interested in joining the discussion on this topic or learning from others?
During Data Expo 2026, Deeploy is organizing stand-up sessions for data and AI leaders: short, 15-minute discussions in small groups about how to maintain control over AI within your own organization.
This blog post is a contribution from Deeploy, a leading AI Governance Platform. Deeploy helps organizations such as Novo Nordisk maintain oversight and control over their AI systems and agents—from onboarding and assessments to monitoring and guardrails—so they can effectively mitigate risks and safely deploy high-risk AI at scale. For more information, visit the Deeploy website or stop by the Deeploy booth at Data Expo.
