AI Is Moving Faster Than the Rules Meant to Control It
The newest AI security tools can act on a network without human approval. The governance frameworks meant to keep that in check weren't written for this.
Key points
- Artificial intelligence is now being used inside cybersecurity tools to make decisions with little or no human review.
- Governance frameworks, the rulebooks organisations use to manage risk and stay compliant with regulations, haven't kept up with how quickly AI capabilities are advancing.
- A new category called "agentic AI" can take independent actions on a network, going beyond flagging problems to actually intervening.
- Security practitioners and policymakers are debating whether current compliance standards are fit for purpose in an AI-driven environment.
Artificial intelligence doesn't just help security teams anymore. It acts. The newest generation of tools can scan a company's systems and respond to threats without a human pressing a single button, and that shift raises an uncomfortable question: who is actually in charge?
That's the problem at the centre of a conversation SecurityWeek recently highlighted involving MindStone, an AI platform designed to build and deploy what the industry calls "agentic AI," meaning AI that operates with a degree of independence rather than simply answering questions or producing reports. We first covered MindStone on 17 July 2026.
The worry isn't science-fiction. It's quieter and more practical. When an AI system decides to block a user or reconfigure a network setting, the old compliance playbooks, written for humans making those calls, may not apply cleanly.
Who is responsible when AI makes a security call?
Nobody has a clean answer yet. Regulations like GDPR, the European data protection law, or HIPAA, the American law protecting patient health records, were written assuming a person sat somewhere in the decision loop. Agentic AI removes that person, or pushes them much further back.
Governance is the system of rules and checks an organisation puts in place to make sure decisions are made responsibly and traced to someone accountable. Security teams are finding those systems weren't designed with autonomous AI in mind. Our June reporting on AI governance found CIOs caught between board pressure for AI returns and compliance teams demanding guardrails, a tension that hasn't eased.
Capability is outrunning intent. Vendors can build AI that acts; the harder work is defining what it's allowed to do, what it must log, and who answers for its mistakes. Medium confidence: that logging gap is where the next regulatory fight lands.
Should you worry?
If the AI your organisation relies on holds medical records or bank details, the answer is yes, moderately. The risk isn't a rogue system. It's decisions made outside auditable processes, errors that are harder to catch, abuses that are harder to prove.
If you work in an organisation that's started using AI security tools, ask your IT team one question: can a human override or audit every decision this system makes? An uncertain answer is the gap the industry is now scrambling to close.
