Weekly signal

A compact regulatory pulse on agentic AI for the week of 2026-11-02 through 2026-11-10: major prudential, national-security and sectoral regulators published practical supervisory resources and new enforcement structures that directly target AI agents (aka agentic or autonomous AI). Key signals this week show (a) supervisory prioritisation of agent identity, delegated authority and registries, (b) powers and proposals to treat "loss of control" incidents as reportable for critical operators, and (c) the creation of enforcement desks and examiner frameworks that shift attention from labels to consequences.

What changed

1. Hong Kong (HKMA) published a formal Discussion Paper on agentic A.I. governance for banks and launched Project SAGE to explore agent identity ("Know Your Agent"), registries of material agents, lifecycle governance and mandatory evidence/traceability expectations for material banking agents. The paper frames "intent-anchored accountability" — every agent must have a documented business intent, named accountable owners and stop/rollback mechanisms.

2. United Kingdom (UK) government updated a factsheet under the Cyber Security & Resilience (NIS) Bill to propose four "agentic loss of control" measures (security/resilience requirements, affected‑party notification, evidence preservation, and ministerial post‑incident review powers). Those measures would be enabled by delegated powers and secondary legislation after Royal Assent. This is a template for mandatory incident rules aimed at essential and digital service operators.

3. United States Office of the Comptroller of the Currency (OCC) issued an examiner framework—Bulletin 2026‑54—covering "Super Intelligence" (OCC’s term for advanced AI) that explicitly includes generative and agentic systems and ties examiner intensity to consequence and autonomy. It is an examiner resource (not new law) but signals supervisory expectations for banks.

4. U.S. Department of Justice created a Super Intelligence Task Force (DOJ‑SITF) to coordinate criminal/civil enforcement related to misuse of advanced AI; the press release emphasises deconfliction, enforcement priorities and engagement with White House SI structures. This raises enforcement risk and expectation of internal controls and reporting.

5. Japan’s Digital Agency published provisional GENAI standards for government deployments (GENAI), clarifying roles, administrator responsibilities, in‑country data handling and that AI agents in government must be operated under named administrators with audit logs and intervention controls. This is effectively a binding operational standard for government agent deployments.

What to do with it

1. Immediate: inventory all agentic systems (internal and customer‑facing), tag materiality, and assign a named accountable owner per agent — this mirrors HKMA and OCC expectations and will shorten supervisory conversations.

2. Incident readiness: ensure monitoring that can flag "loss of control" behaviours, preserve runnable logs (chain‑of‑thought/decision traces), and document how evidence will be retained for investigations — UK proposals and HKMA examples make evidence preservation and notification core requirements to watch.

3. Contracts & vendors: update third‑party contracts to require vendor cooperation on identity/authentication (KYA), access revocation, forensics support and prompt notification. DOJ and OCC signals increase the enforcement and supervisory downside of weak vendor controls.

4. Engage: if you operate in or serve UK/HK/Japan/US markets, respond to active consultations and regulator calls (HKMA discussion paper, ICO call for evidence, OCC supervisory materials) to shape practicable rules and buy time for engineering steps.

5. Build defensibly: design agent harnesses that embed intent limits, deterministic approval gates for irreversible actions, velocity limits and clear kill switches; log agent identity, invoked tools and escalation traces to support audits and regulator requests. These map directly to the new supervisory playbooks.

(References: HKMA Discussion Paper; UK Agentic AI resilience measures factsheet; OCC Bulletin 2026‑54 Supervisory Framework; DOJ press release on Super Intelligence Task Force; Japan Digital Agency GENAI provisional standards; FCA APM responses.)