AI Is Moving Faster Than the Rules Meant to Control It
Artificial intelligence is reshaping how organisations defend themselves online, but the policies and oversight structures meant to govern that AI are struggling to keep pace.
Key points
- Artificial intelligence is now being used inside cybersecurity tools to make decisions with little or no human review.
- Governance frameworks, meaning the rulebooks organisations use to manage risk and stay compliant with regulations, have not kept up with how quickly AI capabilities are advancing.
- A new category of AI called "agentic AI" can take independent actions on a network, going beyond simply flagging problems to actually doing things.
- Security practitioners and policymakers are debating whether current compliance standards are fit for purpose in an AI-driven environment.
Artificial intelligence does not just help security teams anymore. It acts. The newest generation of AI tools can scan a company's systems, make decisions, and take steps to respond to threats, all without a human pressing a single button. That shift is forcing a hard question: who is actually in charge?
This is the problem at the centre of a conversation SecurityWeek recently highlighted involving MindStone, an AI platform designed to build and deploy what the industry calls "agentic AI," meaning AI that operates with a degree of independence rather than simply answering questions or producing reports.
The concern is not that the AI will go rogue in some science-fiction sense. The concern is quieter and more practical. When an AI system decides to block a user, quarantine a file, or reconfigure a network setting, the old compliance playbooks, which were written for humans making those calls, may not apply cleanly.
Who is responsible when AI makes a security call?
Right now, nobody has a clean answer. Regulations like GDPR, the European data protection law, or HIPAA, the American law protecting patient health records, were written assuming a person sat somewhere in the decision loop. Agentic AI removes that person, or at least pushes them much further back.
Governance, in plain terms, is the system of rules and checks an organisation puts in place to make sure decisions, including security decisions, are made responsibly and can be traced back to someone accountable. Security teams are discovering those systems were not designed with autonomous AI in mind.
Capability is outrunning intent. Vendors can build AI that acts. The harder work is defining what it should be allowed to do, what it must log, and who answers for its mistakes.
For ordinary people this matters because the systems AI is being trusted to protect hold medical records, bank details, and personal data. If the AI governing those systems operates outside clear rules, errors, or abuses, become harder to catch and harder to fix.
If you work in an organisation that has started using AI security tools, it is worth asking your IT team one simple question: can a human override or audit every decision this system makes? If the answer is uncertain, that is the gap the industry is now scrambling to close.
