Agentic AI Doesn’t Get a Governance Exemption -Not Under CMMC, Not Under State Privacy Law

On May 21, 2026, the New York Department of Financial Services sent every bank, insurer, and licensed financial entity under its cybersecurity regulation two industry letters in the same afternoon. One warned that “frontier” AI models can now accelerate vulnerability discovery and exploit development faster than most security teams can patch. The other told regulated entities what to do about it: validate AI-generated code with human oversight before it reaches production, and treat AI systems as another set of actors that has to answer to the same access controls as everyone else with a login.

Regulators don’t usually issue two advisories on the same day unless they believe the ground has already shifted under the industry they oversee. NYDFS has a habit of following its advisories with targeted enforcement. Whatever a bank’s AI governance program looks like on paper, an examiner is going to ask whether it actually reaches the agents already running inside the environment.

That question is no longer specific to New York, or to banking. It’s the same question the Defense Department is about to start asking defense contractors, and the one 20 state privacy regulators are already positioned to ask any company handling consumer data.

A governance gap with a receipt attached

The gap regulators are reacting to shows up clearly in the data. Three-quarters of companies (76%) are already using or planning to use agentic AI within the next year, according to EY’s 2025 Responsible AI Pulse survey of 975 C-suite leaders across 21 countries, but only 56% say they’re familiar with the risks that come with it. That’s a lot of deployment ahead of a lot of understanding.

Security assessment practices are catching up, just not fast enough. The World Economic Forum’s Global Cybersecurity Outlook 2026 found that the share of organizations formally assessing an AI tool’s security before deploying it nearly doubled year over year. Even with that improvement, roughly a third of organizations are still putting new AI tools into production with no formal security review at all.

The cost of that gap is measurable. DTEX Systems and the Ponemon Institute’s 2026 Cost of Insider Risks Global Report puts the average negligent-insider incident, a category that increasingly includes unsanctioned or unmonitored AI agent activity, at $747,107, and found that negligent insiders now drive 53% of the $19.5 million organizations spend annually on insider risk, a negligent-insider cost of roughly $10.3 million, up 17% year over year. Agents that operate outside established access controls behave, statistically, like negligent insiders.

Why the bolt-on approach doesn’t hold up

The common response in security organizations has been to treat AI governance as its own program: a use policy, a review committee, maybe a monitoring tool that watches prompts and outputs. That’s a reasonable starting point, and it’s also where a lot of programs stall, because it treats an agent as a new kind of problem that needs new plumbing, instead of a new kind of identity that needs the plumbing security teams already built for people.

For defense contractors, that distinction is about to have a deadline attached to it. The Defense Department’s CMMC 2.0 requirements became contractually enforceable through DFARS 252.204-7021 on November 10, 2025. Starting November 10, 2026, Level 2 contracts move to mandatory third-party certification. An agent connected to a contract management system or a repository holding controlled unclassified information is, for CMMC purposes, another actor touching that data. A parallel AI governance track that isn’t wired into the same access controls and audit logging an assessor is about to test doesn’t satisfy the assessment. It just gives the assessor a second system to ask about.

The same problem shows up in privacy compliance. Twenty states now have comprehensive consumer privacy laws in effect, according to MultiState’s 2026 tracking, each with its own rules on data minimization, consumer rights requests, and automated decision-making. An agent that pulls a consumer record to close out a support ticket must respect the same access boundaries and leave the same audit trail a human employee would, in every one of those jurisdictions. Two separate record-keeping systems make that reconciliation a permanent, manual job.

Treat agents as a second class of governed identity, not a side project

The fix isn’t a governance stack built specifically for agents. It’s recognizing that agents are a second class of identity operating inside the control plane that already governs people: same authentication, same role- and attribute-based access rules, same encrypted handling, same audit trail feeding the same SIEM. An agent shouldn’t be able to see or move data that a human in its role couldn’t touch, and every action it takes should generate the evidence a compliance team would need to answer a CMMC assessor, a state attorney general, or an NYDFS examiner, without a second system to reconcile.

That’s the thinking behind the Kiteworks Agent Marketplace, which we launched this year. It’s a library of more than 50 agents covering compliance checks across frameworks including CMMC, FedRAMP, HIPAA, and NIST SP 800-53, plus accessibility checks and data governance tasks like retention cleanup and contract review. They install directly into Claude and connect to a customer’s existing environment through a secure MCP server. Every agent authenticates with OAuth 2.0, inherits the access rules already assigned to the human role it’s acting under, and logs its activity to the same audit trail security teams already monitor. The agent and skill logic is published openly, so a security team can read exactly what an agent does before it runs, request a change, or flag something for review, the same due diligence they’d apply to any other tool touching sensitive data. None of that makes an agent’s output a substitute for a compliance team’s own determination. What it does is make the agent’s activity visible in the same place everything else already is.

NYDFS, the CMMC assessors arriving next November, and the privacy regulators in 20 states aren’t going to ask whether an organization has an AI governance program on paper. They’re going to ask whether it can produce one access log accounting for every actor, human or agent, that touched a given record. The security teams that can answer that from a single system, instead of stitching two together after the fact, are the ones that will actually be ready. 

_____

About: Rick Goud is Field CTO at Kiteworks, where he works with security and compliance teams in regulated industries to architect governance for sensitive data exchange, including the emerging category of AI agents. More at kiteworks.com.