Signal Scanner · REGULATION, STANDARDS & POLICY CHANGE

After Human-in-the-Loop: Regulators Concede Oversight Cannot Scale to Agentic AI

As AI rules still demand a human in the loop, 2026's supervisory signal is the quiet admission that human oversight cannot keep pace with agentic systems. The exposure runs to boards, compliance, model-risk teams and AI vendors across banking and capital markets.

The consensus on AI governance has a comforting centre: keep a human in the loop. Regulators worldwide lean on human oversight, senior-manager accountability and model validation as the answer to opaque systems. The 2026 detail underneath is less reassuring. As agentic AI, software that plans, remembers and acts toward goals, reaches financial workflows, supervisors and firms are quietly admitting that a human cannot meaningfully review decisions taken at machine speed and scale. The control model is being reset from watching an AI's steps to governing its objectives, guardrails and outcomes, and formal model-risk rules are narrowed to exclude these systems. The question for boards is no longer whether a human is in the loop, but what oversight means when the human cannot keep up.

Signal Identification

This is a regulatory pivot driven by a capability change, not a compliance tweak. The binding variable is speed and autonomy: when an agent makes many decisions a minute and chains actions across systems, point-by-point human review and model validation stop working. On current evidence regulators are not abandoning oversight; they are relocating it to objectives, monitoring and outcome guardrails, and conceding that formal model-risk rules no longer fit.

Time horizon: 1–3 years (live now; rules and guidance reset through 2026-2027) Plausibility band: Medium–High Geographic / Jurisdictional Scope: Global standard-setters (IOSCO, FSB) with primary regulatory action in the United Kingdom (Bank of England, PRA, FCA) and United States (Federal Reserve, OCC, FDIC); EU AI Act human-oversight rules as the baseline under strain. Sectors exposed: Banking, capital markets and insurance; compliance, model-risk and second-line functions; boards and senior managers; AI and cloud vendors; auditors and assurance providers.

What's Changing

The admission is now on the record. IOSCO's final Supervisory Toolkit for AI Use in Capital Markets warns that agentic AI will have profound impact, notes members already experimenting with AI that oversees other AI, 'AI as a judge', and flags rising concern about control and accountability for such systems (IOSCO, 25/05/2026). The Bank of England's roundtables with regulated firms were blunter: traditional model risk management validation 'wouldn't be sustainable' as agentic systems proliferate, and the 'human-in-the-loop' concept was 'challenged by the rise of agentic AI', with firms urging a shift to testing, monitoring and guardrails around outcomes (Bank of England, 16/02/2026).

Rules are being narrowed to match. The Federal Reserve, with the OCC and FDIC, amended its model risk management guidance to clarify that it 'does not apply to generative or agentic AI', leaving formal model-risk rules to cover only traditional models, while Vice Chair Bowman asked whether supervisory guidance is 'fit for the future' (Federal Reserve, 01/05/2026). The OCC's spring risk report still wants 'human oversight embedded in workflows', even as the three agencies prepare a request for information on model risk management for AI (Consumer Finance Insights, 19/05/2026).

The response is to govern higher up. The FSB's June consultation sets 12 sound practices aimed at boards and senior management, covering governance, the AI lifecycle and third-party risk, with a final report due as a G20 deliverable (Financial Stability Board, 10/06/2026). The World Economic Forum puts the logic plainly: systems operating at machine velocity 'cannot be audited retroactively', so boards should move from auditing execution to governing the reward function and engineer 'legible friction', pause points for high-stakes actions (World Economic Forum, 28/04/2026).

Disruption Pathway

The pathway runs in three stages. First, exclusion: supervisors carve generative and agentic AI out of model-risk rules built for static models, because validating an agent's inner workings is no longer feasible. Second, relocation: oversight moves up and outward, from checking individual decisions to approving objectives, setting guardrails, monitoring outcomes and, in some firms, using AI to watch other AI. Third, accountability transfer: with formal rules silent, responsibility lands on boards, senior managers and second-line functions to show their own governance is adequate.

Three pressure points concentrate the risk. Individual-accountability regimes such as the UK Senior Managers regime assume a person can understand and answer for a decision, which agentic systems strain (Inside Global Tech, 09/04/2026); second-line functions lack the skills and tools to validate fast-moving models; and cross-border firms face divergent approaches across the UK, US and the EU AI Act. Two adaptations follow. Supervisors are moving toward outcome- and guardrail-based testing rather than model inspection; and firms are being pushed to encode oversight into systems, from pause points to automated monitors, rather than rely on a reviewer who cannot keep pace.

Why This Matters

For boards, compliance leaders, model-risk teams and AI vendors, the assumption to retire is that a human reviewer satisfies the oversight duty. As agentic systems take on decisions, regulators expect firms to prove that objectives, guardrails and monitoring are designed in, not that a person nominally signs off. Boards should expect to own decisions made by autonomous agents under their authority; second-line functions should rebuild validation around outcomes and behaviour rather than model internals; and vendors should expect oversight features such as logging and override to become procurement requirements. The decision-relevant horizon is the next 18 months of consultations and guidance, not a distant AI future.

Decision-action posture for this signal: Prepare — the breakdown is acknowledged and rules are being narrowed now, but the replacement model is still in consultation, leaving time to redesign oversight and commit on named triggers.

Counter-Argument

The strongest objection is that nothing fundamental has changed: regulators still insist on human oversight, the OCC wants it 'embedded in workflows', and supervisors stress that accountability is non-transferable (Consumer Finance Insights, 19/05/2026). On this reading, narrowing model-risk rules is housekeeping, and existing principles plus senior-manager accountability are enough to absorb agentic AI without a new control model.

But insisting on human oversight while conceding it cannot scale is the tension, not its resolution. When the Bank of England's own firms say validation is not sustainable and the human-in-the-loop is challenged (Bank of England, 16/02/2026), keeping the words while emptying the mechanism shifts real risk onto whatever fills the gap, whether encoded guardrails, AI monitoring AI, or unexamined autonomy.

Implications

On the available evidence, this is a durable change in what oversight means, not a passing definitional debate. The inflection window is 2026 to 2027, as IOSCO's toolkit, the FSB's practices and amended model-risk rules settle. Firms that rebuild oversight around objectives, monitoring and encoded guardrails gain a defensibility advantage; those that keep a nominal human reviewer over systems they cannot follow carry hidden liability. The open question is whether supervisors converge on a shared outcome-based model or leave a patchwork that agentic systems exploit across borders.

Early Indicators to Monitor

Disconfirming Signals

Strategic Questions

Keywords

agentic AI; human-in-the-loop; AI governance; model risk management; IOSCO supervisory toolkit; FSB sound practices; Senior Managers regime; AI as a judge; supervisory oversight; board accountability; capital markets; financial regulation

Bibliography

Source tiers: Tier 1, governments, regulators and intergovernmental bodies. Tier 2, think-tanks, academic institutes, major consultancies and quality data providers. Tier 3, quality journalism and specialist trade press. Tier 4, vendor, company and practitioner sources, used only as directional corroboration.

Prepared by Shaping Tomorrow: 22 June 2026

This Signal Scan is one component of a Shaping Tomorrow intelligence cycle on Regulation, Standards & Policy Change. Every monitored topic also includes monthly Change Trackers that assess what is materially shifting in momentum, and a quarterly Decision Intelligence briefing that converts the cycle into board-level strategic implications. Cycles may also close with Action Triggers, an end-of-cycle synthesis that reads across the three formats and surfaces patterns no single deliverable carries on its own. Continuous intelligence on this topic is available as a Single-Topic or Multi-Topic programme.

Discuss a Tailored Programme