AI Governance Before You Deploy Agents: What Mid-Size Companies Need
EU AI Act transparency rules, such as telling people they're talking to AI, apply from this date
2 Aug 2026
New date for Annex III high-risk obligations after the AI Omnibus, according to the European Commission
2 Dec 2027
Core functions in the NIST AI Risk Management Framework: Govern, Map, Measure and Manage
4
Use this article with AI
Open a buyer-ready brief in your preferred assistant.
ChatGPT, Claude, Perplexity and Grok open with the prompt attached. Gemini copies the prompt to your clipboard first.
Mitori
Article assistant
Ask about this article
I can help you understand the key arguments, how they apply to your organisation, and what questions to ask next.
Powered by Mitori · Scoped to this article
Before deploying AI agents, a mid-size company needs four things: an inventory of where agents will act, written limits on what each may do alone, approval and escalation rules for everything else, and a log of every action. Then check which EU AI Act dates apply and use the NIST AI RMF to structure the work.
Mitori is an operational intelligence platform that observes how work actually happens across your people, tools and handoffs, then tells you what to automate first, in what order and under what controls — and builds and monitors the AI agents that do it.
Why do AI agents need governance before deployment?
Because an agent acts, not just advises. Once software can send messages, update records or book appointments on its own, the questions of what it may do, who approves the rest and how you would know if it went wrong have to be answered before it starts, not after the first incident.
With a chatbot, a person reads the output and decides. With an agent, the decision is often the output. That shifts governance from reviewing content to designing control points into a workflow: where the agent stops and asks, what it can never do, and what record it leaves behind.
Late governance is one of the most common reasons agent projects stall. According to Gartner, more than 40% of agentic AI projects will be canceled by the end of 2027, and inadequate risk controls are one of the three causes it names, alongside escalating costs and unclear business value. In practice, a risk review that arrives after the demo finds actions nobody approved, and the project goes back to the start.
Mid-size companies feel this most. They rarely have a dedicated AI risk team, so governance has to be light enough to run with the people they already have, and specific enough to satisfy a customer's security review or a regulator's question.
Read next:Why AI pilots fail →
What does the EU AI Act Digital Omnibus change for companies deploying agents?
The AI Omnibus, Regulation (EU) 2026/1744, entered into force on 27 July 2026. It moves the obligations for Annex III high-risk AI systems to 2 December 2027 and for high-risk systems in regulated products under Annex I to 2 August 2028. It did not move the transparency obligations, which apply from 2 August 2026.
According to the European Commission, the AI Act became applicable on 2 August 2026 with some exceptions. Prohibited practices and AI literacy obligations have applied since 2 February 2025, and the rules for general-purpose AI models since 2 August 2025. Following the Omnibus, the Commission lists 2 December 2027 for Annex III high-risk use cases and 2 August 2028 for AI embedded in products covered by Annex I.
Two practical points for a company planning agents. First, the transparency rules are live now. According to the Commission, they include telling people when they are interacting with an AI system such as a chatbot, and labeling deepfakes and certain AI-generated text. An agent that talks to customers, patients, candidates or suppliers should say it is AI and explain how to reach a person.
Second, the delay is not a reason to wait. Annex III covers areas many mid-size businesses touch, including employment and recruitment, access to essential services, and creditworthiness. If an agent screens job applicants or helps decide who gets a service, the high-risk obligations, such as risk management, human oversight, logging and documentation, will apply from December 2027. Building them in now is cheaper than retrofitting.
The AI Act applies beyond EU-based companies, including where an AI system's output is used in the EU. This article is a practical summary, not legal advice. Confirm which obligations apply to your systems with counsel.
| Obligation | Date that applies | What it means for an agent rollout |
|---|---|---|
| Prohibited practices and AI literacy | 2 February 2025 | Check no agent use falls into a banned category; make sure the people running agents understand them |
| Transparency (Article 50) | 2 August 2026, not moved by the Omnibus | Agents that interact with people should disclose they are AI; label AI-generated content where required |
| High-risk systems in Annex III | 2 December 2027 (moved by the Omnibus) | If an agent touches hiring, essential services or credit, plan for risk management, human oversight, logging and documentation |
| High-risk systems in regulated products (Annex I) | 2 August 2028 | Mainly relevant to manufacturers whose products already need EU conformity assessment |
Obligation
Prohibited practices and AI literacy
Date that applies
2 February 2025
What it means for an agent rollout
Check no agent use falls into a banned category; make sure the people running agents understand them
Obligation
Transparency (Article 50)
Date that applies
2 August 2026, not moved by the Omnibus
What it means for an agent rollout
Agents that interact with people should disclose they are AI; label AI-generated content where required
Obligation
High-risk systems in Annex III
Date that applies
2 December 2027 (moved by the Omnibus)
What it means for an agent rollout
If an agent touches hiring, essential services or credit, plan for risk management, human oversight, logging and documentation
Obligation
High-risk systems in regulated products (Annex I)
Date that applies
2 August 2028
What it means for an agent rollout
Mainly relevant to manufacturers whose products already need EU conformity assessment
What is the NIST AI RMF and how does it apply to agents?
The NIST AI Risk Management Framework is a voluntary, sector-neutral framework published by the US National Institute of Standards and Technology in January 2023. It organizes AI risk work into four functions, Govern, Map, Measure and Manage, which translate cleanly into the controls an agent rollout needs.
According to NIST, the framework is intended for voluntary use and is non-sector specific and use-case agnostic, which makes it a good fit for a mid-size company that wants structure without a certification program. NIST added a Generative AI Profile, NIST-AI-600-1, in July 2024, and has said the framework is being revised. Here is how the four functions map onto agents:
- Govern: decide who owns each agent, who can approve its actions and who signs off on changes. NIST describes Govern as a cross-cutting function that runs through the other three.
- Map: establish the context. Which workflow does the agent run, which systems and data does it touch, who is affected and what could go wrong?
- Measure: track how the agent performs against the baseline of the workflow it replaced, including error rates, escalations and drift over time.
- Manage: put resources against the risks you mapped and measured: approval rules, escalation paths, rollback plans and regular review.
Read next:Governance-first AI automation for regulated teams →
What governance controls should be in place before an agent goes live?
Before launch, every agent should have a named owner, a written list of permitted actions, approval and escalation rules, scoped data access, full action logging and a way to switch it off. Those controls are what turn a demo into something a business can run.
- 1Inventory the agent's scope. Write down the workflow, the systems it reads and writes, the people it interacts with and the decisions it influences.
- 2Classify the risk. Check whether the use falls under EU AI Act transparency or Annex III high-risk categories, and note any sector rules that apply to your data.
- 3Set action limits. List what the agent may do on its own, what it must never do, and the thresholds, such as amount, customer type or exception type, that trigger human approval.
- 4Design escalation. Decide who receives each type of escalation, how quickly, and what happens out of hours.
- 5Scope data access. Give the agent the minimum access its workflow needs, and confirm retention and deletion rules with your security team.
- 6Disclose AI to people it talks to. Tell customers, patients, candidates or suppliers they are dealing with AI and how to reach a person.
- 7Log every action. Record what the agent did, on what input, and who approved it, so you can review, audit and explain any outcome.
- 8Monitor against the baseline and review regularly. Track performance and drift against the workflow you measured before launch, and decide in advance who can pause or roll back the agent.
How is governance-first different from bolting governance on later?
Governance-first designs the control points into the workflow from the start. Bolted-on governance reviews a finished system and tries to add controls around it, which usually means rework, delays or a project that never ships.
| Dimension | Governance added late | Governance designed in |
|---|---|---|
| When risk is reviewed | After the pilot or demo | Before build, as part of choosing and sequencing the workflow |
| Agent permissions | Whatever the integration allowed | A written list of permitted actions with approval thresholds |
| Escalation | Undefined; exceptions land on whoever notices | Named owners per escalation type, including out of hours |
| Evidence for auditors or customers | Reconstructed after the fact | Every action logged as it happens |
| Regulatory change | Each new date triggers a scramble | Controls already map to transparency and high-risk duties |
Dimension
When risk is reviewed
Governance added late
After the pilot or demo
Governance designed in
Before build, as part of choosing and sequencing the workflow
Dimension
Agent permissions
Governance added late
Whatever the integration allowed
Governance designed in
A written list of permitted actions with approval thresholds
Dimension
Escalation
Governance added late
Undefined; exceptions land on whoever notices
Governance designed in
Named owners per escalation type, including out of hours
Dimension
Evidence for auditors or customers
Governance added late
Reconstructed after the fact
Governance designed in
Every action logged as it happens
Dimension
Regulatory change
Governance added late
Each new date triggers a scramble
Governance designed in
Controls already map to transparency and high-risk duties
How does Mitori build governance into agent deployment?
Mitori starts governance from the observed workflow. The Audit shows where real decisions, handoffs and exceptions happen, so approval and escalation points are placed where the work actually needs them, and every deployed agent is logged and monitored against that baseline.
Mitori follows an Audit → Roadmap → Build → Control model. The Audit runs for 30, 60 or 90 days and observes real work, with consent, across the tools teams already use: email, spreadsheets, chat and business systems. Because it is observed rather than interviewed, it surfaces the exceptions that need a person.
The roadmap scores each automation on savings, effort and confidence, then sequences them into deployment waves with governance checkpoints, including approvals and escalation. Mitori then builds the agents, which start from the observed workflows, and in the Control phase logs every action and tracks drift against the observed baseline.
For questions about consent boundaries, data handling, retention and deletion, see Mitori's trust center. Mitori's agents already run in healthcare operations, including IVF clinics and healthcare staffing agencies, where clinical and sensitive decisions stay with people.
Read next:Mitori trust center →How the Mitori Audit works →Take the AI readiness assessment →How to deploy AI in your business (step-by-step guide) →
Frequently asked questions
Under the AI Omnibus, Regulation (EU) 2026/1744, which entered into force on 27 July 2026, obligations for Annex III high-risk AI systems apply from 2 December 2027. High-risk AI embedded in products covered by Annex I follows on 2 August 2028. Confirm with counsel which category your systems fall into.
No. The transparency obligations in Article 50 were not moved and apply from 2 August 2026. They include telling people when they are interacting with an AI system and labeling certain AI-generated content. Any agent that talks directly to customers, patients or candidates should disclose that it is AI.
No. NIST describes the AI Risk Management Framework as intended for voluntary use, and as non-sector specific and use-case agnostic. Many organizations adopt it because it gives a shared structure, Govern, Map, Measure and Manage, that customers, auditors and boards recognize, without requiring a certification.
For each agent: a named owner, a written list of permitted actions, approval and escalation rules, minimum data access, AI disclosure where it talks to people, full action logging, and monitoring against a baseline with a way to pause it. That covers most of what customers and regulators ask, without building a large program.
It can. The AI Act applies to providers and deployers outside the EU in some cases, including where an AI system's output is used in the EU. If you sell into the EU, serve EU customers or use AI on EU residents' data, check with counsel which obligations apply. This is not legal advice.
Next step
Book an audit scoping call
Talk through where agents would act in your workflows and which approvals, escalations and logs they would need before launch.
Sources
Related reading
AI Deployment Guide
How to Deploy AI in Your Business: A Step-by-Step Guide (2026)
How to deploy AI in your business in 7 steps: observe real work, pick workflows by evidence, set governance, build agents with approvals, then scale in waves.
Governance
Governance-First AI Automation for Regulated Teams
Regulated teams do not need more automation ideas. They need a rollout model that survives audit, exception handling, and executive scrutiny.
Readiness
Is Your Business Ready for AI Agents? A Readiness Checklist
An AI agent readiness checklist: five areas to check before you deploy agents, covering workflow evidence, ROI, sequencing, integrations and governance.
AI Strategy
Why AI Pilots Fail (and How to Get to Production)
Why AI pilots fail: the research points to workflow fit, missing baselines and late governance, not model quality. Seven failure modes and the fix for each.