Three eras, three different problems.
AI governance did not get harder by degree — it changed in kind, twice, in three years. The one-line version: predictive-ML governance validated an artifact; GenAI governance evaluates a system's behavior; agent governance authorizes an actor — continuously, at runtime, with an identity, a budget, and an audit trail.
Predictive ML
Governs: A model you built. Core question: Is the model sound?
Classic model risk management (SR 11-7 shape): validate before deployment, monitor for drift, revalidate on schedule. It worked because models were deterministic, bounded, in-house, versioned, and used by a few experts.
Generative AI
Governs: A system you assembled. Core question: Does the system behave?
Third-party models, unbounded natural-language input, non-deterministic output, every employee a user. The unit of validation becomes the pipeline — retrieval + prompt + model + output handling — and evaluation becomes continuous.
Agentic AI
Governs: An actor you authorize. Core question: What may it do — and who can stop it?
AI with identity, tools, memory, and delegated authority. Wrong answers become wrong actions. Governance moves to runtime authorization: per-agent identity, scoped permissions, approval gates, budgets, audit trails, kill switches.
Seven assumptions classic governance relied on.
Bank-grade model risk management encoded quiet assumptions. GenAI broke five; agents break the rest. Each break implies a specific new control — this table is the bridge from 'our MRM program covers AI' to what modern coverage really takes.
| Old assumption | How it breaks now | The control that replaces it |
|---|---|---|
| Deterministic outputs | Same prompt, different answers — validation can't be a fixed test-vector pass | Statistical eval over behavior distributions; runtime guardrails |
| Enumerable input space | Input is unbounded language (and images, audio); adversarial inputs are infinite | Red teaming as a program; input/output screening in the request path |
| You built the model | Frontier models are third-party; weights and training data not inspectable | Vendor due diligence, model/system cards, benchmark acceptance, contracts |
| Stable versions | Providers update hosted models continuously — behavior shifts without your change ticket | Version pinning, retirement runbooks, regression evals on provider updates |
| Behavior fixed at training | A system-prompt edit is a production behavior change with no retraining | Prompts under change control with safety eval gates (the Grok lesson) |
| The model is the unit | The real unit is retrieval + prompt + model + tools + UI | System-level validation; grounding metrics; an AI system inventory |
| Few expert users | Every employee operates models through assistants and copilots | Acceptable use, literacy duties, DLP on prompts, tiered access |
Nothing on the right side of this table is a document. Every replacement control is a system property — which is why AI governance became a platform conversation.
Deployers are now regulated parties.
You do not have to build AI to owe obligations — using it is enough. The dates below are the ones enterprise programs are actually planned around. (Regulation shown as binding law; see Sources for the full register and claim types.)
EU AI Act: prohibitions + AI literacy duties apply
Banned practices enforceable; every provider and deployer owes AI literacy measures.
EU GPAI model obligations apply
Documentation, copyright policy, training-content summaries for general-purpose models; Code of Practice signed by Google, Microsoft, OpenAI, Anthropic, Amazon — Meta declined.
Korea's AI Basic Act takes effect · California SB 53 + Texas TRAIGA live
First comprehensive national AI law after the EU (extraterritorial, high-impact regime); US states diverge as federal posture turns deregulatory.
EU Commission enforcement over GPAI begins · most transparency duties apply
Chatbot disclosure, synthetic-content marking, deepfake labeling now due; fines to €15M/3% for these duties, €35M/7% for prohibited practices.
EU high-risk obligations (re-scheduled by the 2026 Digital Omnibus)
Annex III standalone systems by Dec 2027; product-embedded by Aug 2028. Deferred, not cancelled — deployer duties (Art. 26) arrive with them.
The through-line across the EU, Korea, and US states — whatever their differences: inventory your AI, tier it by risk, assess impact, keep humans in oversight, log operation, and report serious incidents. Those six verbs are exactly what the seven-layer stack operationalizes, which is why one governance program can serve every regime.
The customer's existing MRM program is the right instinct pointed at the wrong unit — extend it from artifacts to systems to actors.
- 62% of organizations are experimenting with agents but only 23% are scaling — security and risk is the #1 blocker (McKinsey, 2026). Governance is the unlock.
- The EU's high-risk deferral to Dec 2027 is planning time, not a reprieve: transparency duties and GPAI enforcement are already live.
- Every broken-assumption row is a discovery question in disguise: ask which ones their current program actually covers.
- Agents are 12–18 months ahead of statute — the frameworks (OWASP agentic, SAIF 2.0) exist, the law doesn't yet. Leaders set their own bar now.
- Which era is your governance program built for — artifacts, systems, or actors?
- Who tracks your obligations calendar across the EU, Korea, and US states — and what's due next?
- When a model provider updates a hosted model, what happens on your side?
- If an agent misfired tomorrow, which of the seven broken assumptions would the post-mortem cite?