When AI moves from recommending actions to executing them across business systems, operational risk shifts fundamentally. Drawing on October 2026 Bank of England and FCA research, alongside ICO and NCSC guidance, we examine how businesses can deploy AI agents safely with clear boundaries around authority.
An AI that drafts an email is useful.
An AI that sends it has been given authority.
At first glance, the difference looks like a minor configuration change. One click fewer for a member of staff.
In operational terms, a boundary has been crossed.
Until recently, most businesses encountered AI through generative tools that summarise documents, draft text or answer questions. When a model produces a clumsy paragraph or misreads a figure, a person can spot the mistake, edit it or ignore it. The output stays advisory.
Agentic AI changes that relationship. Instead of stopping at a recommendation, an AI agent connects to software tools, databases and internal systems to carry out actions directly.
Consider everyday workflows: drafting an email versus sending it; reading an invoice versus approving payment; reviewing CRM records versus modifying them; or recommending a purchase versus placing an order. Once a system can act, the question is no longer just how capable the model is. It is who decides what it is allowed to do.
What the latest research tells us
On 26 October 2026, the Bank of England and the Financial Conduct Authority published Artificial Intelligence in UK Financial Services – 2026. Based on responses from 196 financial services firms, with 105 completing the full questionnaire, the report shows how AI agents are being deployed in practice.
Across the combined questionnaires, 86% of participating firms reported using AI. Among relevant full-survey respondents, 80% reported deploying AI agents.
Yet when you examine the authority granted to those agents, the contrast is striking. While 80% of relevant full-survey respondents reported decision-support agents, 46% reported constrained-execution agents, 22% reported conditional-autonomy agents, and just 2% reported broad-autonomy agents. (These figures relate to participating financial services firms rather than all UK businesses, and because firms can deploy agents across several categories, the percentages overlap.)
80% of relevant full-survey respondents reported deploying AI agents (and 80% decision-support), while just 2% reported broad-autonomy agents (overlapping categories).
94% reported firmwide AI policies, principles or standards, yet fewer than half reported having AI incident-management and response playbooks.
That gap between 80% deploying agents and 2% granting broad autonomy is not evidence of immaturity. Organisations are adopting agents, but retaining sensible boundaries around their authority.
Where the survey exposes a real gap is between written policy and operational controls. Although 94% reported firmwide AI policies, principles or standards, fewer than half had AI incident-management and response playbooks. Meanwhile, 39% of reported AI systems, and 53% of high-materiality AI systems, were third-party implementations. Writing a policy is easy; maintaining monitoring, supplier assurance and incident response across live systems is much harder.
Not every agent needs the keys
The Bank of England and FCA report groups agent deployments into four overlapping reporting categories that offer any business a clear framework for authority.
Levels of AI agent autonomy in participating UK financial firms
Share of relevant full-survey respondents reporting each category. Categories overlap because firms may deploy multiple agent types.
Decision support
Constrained execution
Conditional autonomy
Broad autonomy
Population note: Overlapping proportions of relevant full-survey UK financial services respondents (within the 105 full-survey cohort), not percentages of individual agents or all UK businesses.
The appropriate level of autonomy always depends on risk, business requirements and the consequences of an error. Most workflows do not need broad autonomy to deliver commercial value.
A practical business example
To see how quickly consequences change, consider a hypothetical customer service scenario.
Five stages of customer service agent authority
As the agent gains permissions, the potential business consequences shift at every step.
-
Recommending a response
An agent receives a customer enquiry and recommends a reply to a human adviser. A poor suggestion is simply ignored.
-
Retrieving CRM information
The agent can retrieve customer records from the CRM. Data scoping now matters: it must only access records for the verified customer.
-
Drafting an approved response
The agent saves a categorised draft inside the ticketing queue. It now modifies internal workflow state, requiring logging and validation.
-
Sending responses automatically
The agent sends replies directly to customers. It now speaks for the business, turning errors or data leaks into external liabilities.
-
Issuing refunds
The agent is allowed to issue refunds. Without hard financial limits and approval gates, a single fault or manipulative prompt causes direct financial loss.
What begins as an internal drafting aid can quietly evolve into a system that reads personal data, speaks to customers and moves company money. That is why permissions, approval points, logging and escalation must be designed into the system from the start.
Governance that actually works
Effective AI governance is more than a policy document. When software can act, governance depends on technical and operational controls proportionate to the risk.
"Simply instructing an AI agent in a prompt to behave responsibly is not a security boundary. Real boundaries have to be enforced by the architecture around the model."
As the National Cyber Security Centre noted in Managing the cyber risk of agentic AI (20 August 2026), language models processing untrusted inputs remain vulnerable to manipulation. Telling an agent in a system prompt never to issue an unauthorised refund is not a security boundary. If the agent holds unrestricted access to the payment tool, a crafted input may still persuade it to act.
Practical governance relies on enforceable foundations: clear accountability and ownership; least-privilege permissions; defined operating boundaries enforced by deterministic code; and human approval for consequential actions.
It also requires security testing before deployment, ongoing evaluation, strong data protection, and immutable monitoring and audit trails. When third-party systems are involved, supplier assurance is essential. And as the NCSC emphasised in Thinking carefully before adopting agentic AI (15 May 2026), organisations need tested incident-response playbooks and a reliable way to pause or disable agents immediately.
Above all, controls should match the risk. An agent arranging internal meeting times is not the same as one approving financial transactions.
Why regulators are paying attention
On 8 October 2026, the Information Commissioner's Office opened its Agentic AI call for evidence, which closes on 20 November 2026.
This is a consultation rather than a newly enacted law or final binding agent-specific regulation. However, existing data protection law already applies whenever AI agents access, process and act on personal data. The ICO's focus, covering data protection, accountability, transparency, information security, lawful processing, automated decision-making and fairness, reflects the practical issues businesses face today.
Alongside the NCSC's security guidance, the regulatory message is grounded and practical: understand what your agents can access, constrain what they can execute, and maintain clear human oversight.
The Coal Face AI perspective
At Coal Face AI, we believe good governance should enable useful AI deployments, not prevent them.
An appropriately constrained agent can be commercially valuable without needing complete autonomy. Often, an agent that gathers context, checks rules and prepares work for a person delivers the operational improvement a business actually needs, without unnecessary risk.
Whether we are helping a team assess whether AI is appropriate, providing fractional AI leadership, or engineering bespoke systems, responsible deployment requires five things working together: technical engineering, operational understanding, leadership accountability, appropriate governance and continuous oversight. How AI is integrated into a business is at least as important as which model powers it.
When AI moves from offering advice to taking action, the engineering and governance around it matter more than ever.
Because there's a world of difference between giving AI a task and giving it the keys to your business.