Agentic AI moves from answering questions to taking actions.

A chatbot answers. An AI agent does: it reads a request, decides on steps, and then calls tools to carry them out, such as searching a database, sending an email or issuing a refund. Agentic AI is the general term for systems built this way. The more it can do without asking, the more agentic it is.

Once software can act, its mistakes are actions, not just wrong words. An agent with access to payments or production systems can move money or change data on the strength of a misread instruction or text planted in a document it read, a pattern often called prompt injection. The governance questions shift to permissions and oversight: what tools the agent may call, with what limits, who approves high-impact steps, and whether every action is logged so it can be traced and reversed. The term itself has no legal definition. The EU AI Act defines an AI system as operating with varying levels of autonomy, so agents fall under it the same way other AI systems do, and ISO/IEC 42001 and the NIST AI Risk Management Framework apply to them without a separate rulebook.

The AI system inventory

Each agent should appear with its tools, permissions, data access and owner.

ISO/IEC 42001 risk and impact work

Autonomy and tool access are inputs to the AI risk assessment and the impact assessment.

Access control reviews

An agent's service account needs the same least-privilege review as a human's, often stricter.

A penetration test scope

Testing whether planted instructions can make the agent misuse its tools.

Generative AI

Generative AI produces content. An agent may use a generative model to reason, but what makes it agentic is that it acts through tools.

Robotic process automation

RPA follows fixed scripts written in advance. An agent decides its own steps at run time, which is why its behaviour is harder to predict.

• List every agent, the tools it can call and the data it can reach, and give each an owner.
• Grant the narrowest permissions that do the job and set limits on amounts, records or recipients.
• Put a human approval step in front of actions that are costly or hard to undo.
• Log every tool call with its trigger, and test agents against planted instructions before release.

• GuideAI governance & the AIMSPrinciples, clauses 4–10, the operating model and the first five moves.
• GuideAI risk vs impact assessmentTwo assessments: inward risk and outward impact, and the register.
• GuideAI role emulatorProvider or deployer? Describe your AI and see what's yours to evidence.

Sources: Regulation (EU) 2024/1689 (EU AI Act), Article 3(1), Articles 12 and 14; ISO/IEC 42001:2023 public description; NIST AI Risk Management Framework 1.0 (NIST AI 100-1) and the Generative AI Profile (NIST AI 600-1); OWASP Top 10 for Large Language Model Applications.