TL;DR: Two of the world's most powerful financial regulators publicly admitted, six days apart, that the governance framework for autonomous AI in regulated financial services doesn't exist yet. Firms that treat this as a compliance retrofit will spend 2027 explaining their certifications. Firms that treat it as an architecture problem will have the substrate in place before the rules land.

• On 23 July 2026, the Bank of England's Deputy Governor signalled that agentic AI may require purpose-built regulation, because current frameworks weren't designed for systems that act autonomously across a sequence of decisions.
• Six days later, the US Office of the Comptroller of the Currency excluded agentic AI from its revised model-risk guidance in OCC 2026-13, calling the category "novel and rapidly evolving."
• The FCA made similar public statements within the same window.
• The regulators are not saying a framework is coming soon. They are saying it needs to be built, and they will grade firm answers against principles they can already articulate.
• The substrate required: tamper-evident audit trails, independence properties, constitutional reasoning, and human accountability that survives a deposition.

Two regulators. One week. The governance framework for autonomous AI in regulated financial services does not exist yet, and both of them said so out loud.

If you are a CFO, COO, CIO, or CTO inside a bank, insurer, or asset manager, that admission has consequences you cannot outsource to legal or defer to your vendor. The regulators are not signalling that a framework is coming soon. They are saying the framework needs to be built, and they will grade your answer against principles they can already articulate, even if they haven't codified them yet.

Firms that treat this as a compliance retrofit will spend 2027 explaining what "reasonable basis" meant when they signed the certifications. Firms that treat it as an architecture problem will have the substrate in place before the codification arrives.

This piece covers what that substrate actually looks like, and where most firms are already exposed.

Why existing frameworks don't cover it

Model risk management, as it exists today, was built for a specific kind of AI: a predictive model that takes an input, applies a trained function, and produces a scored output. A credit decision. A trading signal. A fraud flag. The model runs, the output is reviewed, a human decides.

Agentic AI breaks that shape entirely.

An agent doesn't produce one output. It produces a sequence: a plan, an action, a response to the action's result, another action, and so on until an objective is reached or abandoned. It can call tools, read external systems, hold state across decisions, and take actions that are not reversible.

Existing model-risk frameworks assume you can inspect the input, inspect the output, and audit the mapping between them. When the "output" is a chain of 40 autonomous decisions across four systems over 90 seconds, you are no longer auditing a function. You are auditing a policy, executed by a system that can improvise within it.

That is what the Bank of England is pointing at. That is what the OCC excluded from OCC 2026-13. The tooling regulators have is calibrated for a category the technology has already left behind.

Key point: Current model-risk frameworks were built for scored outputs from static models. Agentic AI produces decision chains, and the audit shape is fundamentally different.

What regulators are actually asking for

Read the Bank of England and OCC statements carefully and a specific set of properties emerges. The regulators may not name them in these terms, but the requirements sit underneath the language.

Tamper-evident audit trails

If an autonomous agent makes 40 decisions in a chain, and one breached policy, you need to prove which decision, when it happened, what the agent's state was, and what evidence it had at that point.

Log files won't carry that. Log files are mutable. They can be overwritten, rotated, silently truncated by an ops team acting in good faith. In an adversarial audit, a mutable log produces nothing defensible.

What survives is hash-chained, write-once evidence. Every decision the agent makes is recorded as an entry with a cryptographic link to the entry before it. If a single entry is altered, the chain breaks and the alteration is provable. That is the property regulators actually need, even when they describe it as "auditability."

Most firms deploying agentic AI right now are logging to application log stores. That is not auditable in the sense regulators mean the word.

Independence properties

The system that makes the decision cannot be the system that certifies the decision.

This is the property that trips up almost every enterprise deployment. The AI platform vendor provides the agent, the observability, the guardrails, and the reporting, all from the same substrate. That is a conflict of interest embedded in the architecture. When the reporting says the agent behaved correctly, you are trusting the vendor's implementation to grade its own implementation.

An independent certification layer sits outside the platform, reads the tamper-evident evidence, and makes an assessment that cannot be influenced by the system it is assessing. Aviation has this. Nuclear has this. Financial services will need it.

Most firms don't have it. They have vendor dashboards.

Key point: Independence is an architectural property, not a reporting feature. Vendor-provided oversight cannot satisfy it.

Constitutional reasoning

When an agent takes an action, it needs to be able to point to the rule it applied, not the statistical weight it matched.

"The training data suggested this class of transaction should be flagged" is not a defence in a regulatory examination. "The policy states transactions matching these five criteria must be flagged, and the transaction met four of the five, and the fifth was evaluated as follows" is a defence.

The difference is whether the rules the agent uses are inspectable, stateable, and grounded in something a human wrote. There is a document. The agent references it. Every action can be traced back to a clause in that document. That is what "constitutional" means in this context.

Most AI systems in production today can produce outputs but cannot produce that kind of reasoning trace. That is where the regulatory exposure lives.

Human accountability that survives a deposition

Every AI-influenced decision in a regulated firm has a name attached to it. Someone certifies. Under SOX Section 302 in the US, or equivalent regimes elsewhere, that person needs a reasonable basis for the certification they can defend under oath.

"The AI recommended it" is not a reasonable basis.

"I approved the deployment of an AI agent that operates within a documented policy, produces tamper-evident evidence I have personally reviewed the sampling methodology for, and is certified by an independent layer whose output I have inspected" is closer.

What separates those two positions is not documentation. It is substrate. You cannot document your way to a defensible position if the substrate underneath isn't producing defensible evidence in the first place.

Key point: Constitutional reasoning and human accountability are inseparable. The certification chain is only as defensible as the evidence it rests on.

Where firms are already exposed

The exposure isn't in the AI itself. It's in the architecture surrounding it.

In large banks and asset managers, pilots are running now. Agent-based reconciliation. Agent-based journal entry drafting. Agent-based variance commentary. Pilots produce results, results get reviewed, results become production.

The exposure isn't the pilot. It's the moment the pilot moves to production without the substrate being upgraded. Mutable logs, vendor-provided oversight, no independent certification, no constitutional grounding. What changes is that the agent is now making decisions that touch financial statements, capital allocations, or customer outcomes at scale.

When the auditor arrives, they will not ask about the pilot. They will ask about the production system. What the pilot could defend and what the production system can defend are two different things, and that distance is where firms are currently exposed.

Three practical exposures that appear most often:

The certification chain has a missing link. IT approves the deployment. The business owner approves the use case. Neither can defend the decisions the agent is making at the level of specificity a regulator will require. The person who signs the accounts is one level further removed than that.

The vendor's evidence is treated as the firm's evidence. The vendor produces reports. The firm files them. In an adversarial audit, those reports are the vendor's claim, not the firm's evidence. The firm needs its own independent evidence layer.

The rollback plan doesn't exist. When an agent misbehaves at scale, the firm needs to stop it and reverse the decisions it made. Very few production deployments have a clean rollback path for actions the agent has already taken in external systems.

Key point: Production deployments are inheriting pilot-era substrates. The audit exposure grows the moment scale increases, not the moment the rules arrive.

What to actually build

The framework regulators are pointing at can be built now, without waiting for the codified version. Aviation, nuclear, and pharma have all built independent certification substrates for autonomous systems. The properties are portable. Applying them to financial services AI is the new part.

The build order that works:

1. Constitutional layer first. Write the policy the agent will operate under, in a form the agent can reference at decision time. This forces clarity on what the agent is actually allowed to do, before any code is written.
2. Evidence layer next. Every action the agent takes writes to a hash-chained, write-once evidence store, tied to the policy clause it was taken under. The evidence store is the firm's own substrate, not the vendor's log.
3. Independent certification layer third. A separate system reads the evidence store, samples the actions, and produces attestations that the actions were within policy. This system cannot be provided by the AI vendor.
4. Human accountability layer last, but before production. The person certifying at the top of the chain has read the policy, understood the sampling methodology, and can defend the certification, not because they've reviewed every action, but because the substrate underneath produces defensible evidence they can inspect.

None of this is theoretical. All four layers can be built with technology that exists today. The blocker is not tooling. It's the willingness to build the substrate before the framework catches up, rather than retrofitting under enforcement pressure.

Key point: The build order is fixed for a reason. Constitutional layer before evidence layer before certification layer before human sign-off. Reversing it produces a system that looks compliant and isn't.

The window

Regulatory frameworks in financial services follow a predictable sequence: principles first, then guidance, then rules, then enforcement. The Bank of England and OCC statements are the principles stage. Guidance will follow within 12 to 18 months. Enforcement follows that.

Firms that build the substrate now are positioned to shape the guidance. Firms that wait will be building under time pressure, against a framework they had no input on, with the enforcement window already visible.

The regulators have named what's missing. They are not going to build it for you. They are going to grade your answer.

If you're inside a bank, insurer, or asset manager, the question worth asking this week is not when the regulator will publish the framework. It is: if the enforcement action arrived tomorrow, what evidence would we present, and would it survive.

That question has a specific answer for every firm. Most answers are not the ones the CFO will want to certify to.

The window to build the answer, before it becomes an enforcement question, is now.

Frequently asked questions

What is agentic AI and why does it create new regulatory risk?

Agentic AI produces sequences of autonomous decisions rather than single scored outputs. Existing model-risk frameworks were built for the latter. They cannot audit a 40-step decision chain across four systems the way they can audit a credit score.

Why did the OCC exclude agentic AI from OCC 2026-13?

The OCC described agentic AI as "novel and rapidly evolving" and excluded it from the revised model-risk guidance rather than apply a framework that was built for a different category of system.

What does a tamper-evident audit trail actually require?

Hash-chained, write-once evidence storage. Each decision entry carries a cryptographic link to the prior entry. If any entry is altered, the chain breaks and the alteration is provable. Standard application log stores do not provide this property.

Why can't the AI vendor provide the independent certification layer?

Independence requires that the certifying system cannot be influenced by the system being certified. A vendor providing both the agent and the certification layer is grading its own implementation. That fails the independence property.

What is constitutional reasoning in the context of agentic AI?

Constitutional reasoning means the agent can trace every action back to a specific clause in a human-authored policy document. Statistical pattern-matching from training data is not a defensible basis in a regulatory examination.

What is the build order for a compliant agentic AI substrate?

Constitutional layer first, evidence layer second, independent certification layer third, human accountability layer last but before production. The order is fixed because each layer depends on the one before it to produce defensible evidence.

When will regulators codify the rules for agentic AI?

Based on the current principles stage, guidance is expected within 12 to 18 months of mid-2026 statements from the Bank of England, OCC, and FCA. Enforcement follows after that. The firms building now will have shaped the guidance.

What happens if a firm's rollback plan doesn't exist?

If an agent misbehaves at scale and the firm cannot reverse the decisions it has already taken in external systems, the regulatory and operational exposure compounds. The rollback path needs to be designed before production deployment, not after the first incident.

Key takeaways

• The Bank of England, OCC, and FCA have publicly confirmed that no governance framework exists yet for agentic AI in regulated financial services.
• Existing model-risk management was built for static scored outputs. It cannot audit a sequence of autonomous decisions.
• The four substrate properties regulators require: tamper-evident audit trails, independence from the AI vendor, constitutional reasoning traceable to a human-authored policy, and human accountability that survives a deposition.
• Most firms in production are running on mutable logs, vendor-provided oversight, and no independent certification layer. That is the exposure.
• The build order is constitutional layer, evidence layer, independent certification layer, human accountability layer. Reversing it produces a system that looks compliant and isn't.
• Regulatory principles are already published. Guidance arrives within 12 to 18 months. Firms that build now will shape it. Firms that wait will react to it.
• The enforcement question is not hypothetical. For every firm, there is a specific answer to what evidence it would present tomorrow. Most answers are not the ones the CFO would certify to.