On 10 August 2026, more than a hundred federal officials from more than fifty entities of the United Arab Emirates government sat down in workshops to begin converting their own services to agentic AI. The state news agency carried the release. The strategic track sits under UAE Government 4.0, it names seven pillars, and its stated organizing principle is "human leads, AI enables." Agents are already in service in procurement, tax auditing, customer service and technical support.
The workshops implement a directive issued on 23 April 2026 under the President's directives and announced by Sheikh Mohammed bin Rashid: fifty percent of federal sectors, services and operational functions onto agentic AI within two years. That figure is a stated government aspiration, not an audited plan, and it is labeled as such every time it appears below. Even read at its most conservative, it is the largest declared agentic-AI production commitment any government has made, and the machinery behind it is real: a taskforce, fifty entities, a ninety-day cycle in which each entity picks a service and takes it through exploration, design and implementation planning.
I have spent most of this year building and reviewing the layer that sits underneath deployments like that one, so the question I asked when I read the release was not whether the target is achievable. It was narrower. When a procurement agent inside a federal entity completes a purchase rather than recommending one, which published instrument tells the people running that entity what evidence they must produce afterward, and to whom?
I went looking. In three jurisdictions and one heavily regulated sector, across the same fortnight, the answer came back the same way. The adoption was ordered. The manual was not written.
What was ordered
Four things happened between 10 and 17 August 2026, and they are unrelated to each other except in the way that matters.
A government committed. The UAE workshops, above. The stated target of fifty percent of federal operations within two years is an aspiration announced by the head of government. The apparatus around it is not aspirational at all.
A central bank governor told his industry to spend. On 11 August 2026, Governor Sanjay Malhotra opened FIBAC 2026 in Mumbai with an address titled "Winning in the AI Era: The New Playbook for Indian Banks." He urged lenders to accelerate investment in technology, infrastructure and skills, and named three risks in the same breath: biased and opaque decisions, data-privacy and cyber exposure, and concentration risk arising from dependence on a small number of models or vendors, which he warned could leave the banking system exposed to errors. The address is listed on the central bank's own speeches page with its date and full text. It is not a rule. It is a governor telling bank boards to move.
The banks disclosed what is already running. On 15 August 2026, Business Insider published the fullest per-bank ledger of Wall Street AI deployment I have seen. Every figure in it is self-reported by the institution and aggregated by the press, and should be read that way: JPMorgan with roughly a thousand use cases deployed and a generative-AI platform reaching more than two hundred thousand employees; Goldman Sachs with a reported six-billion-dollar technology budget and Anthropic building agents for accounting and trade functions and for client onboarding; Citi with roughly ninety percent of employees on AI tools and four thousand designated "AI stewards"; and Bank of America with thirty-four generative-AI use cases fully deployed out of more than three hundred approved.
Set aside the arithmetic, which is company arithmetic. The load-bearing fact is the workload list. Trade accounting and client onboarding are not productivity experiments. They are supervised functions with named accountable persons and enforcement precedent.
The pattern showed up outside banking too. On 12 August 2026 a vendor announced an agentic account-opening workflow on a US custodian's advisor platform, in which an agent assembles client data and completes the custodian's digital account-opening flow, returning a draft for advisor review. On 17 August 2026 a clinical documentation vendor announced that partner health systems can deploy its agent to every clinician, embedded in the electronic health record and routed through the health system's existing security and governance pipeline rather than a per-clinician review. Both sets of adoption metrics are vendor-published, and I treat them as vendor claims rather than audited facts. What interests me is the product design rather than the numbers. In the second case the governance mechanics are the feature being sold: "you will not need a separate review" is an assurance argument shipped as a purchase reason.
Five dated events in eight days, across a federal government, a central bank, five global banks, a custodian's platform and three hundred health systems. The direction is unambiguous.
What was not written
Now the other rail.
The United States. On 17 April 2026 the Federal Reserve, the FDIC and the Office of the Comptroller of the Currency issued revised interagency model risk management guidance. The OCC's issuance is Bulletin 2026-13; the Federal Reserve's designation is SR 26-2. It supersedes SR 11-7 and SR 21-8, which means SR 11-7 is no longer current guidance and should not be cited as though it were. The revised guidance says, in a footnote to its scope discussion, that generative AI and agentic AI models "are novel and rapidly evolving" and that "as such, they are not within the scope of this guidance." Separate AI guidance was promised. Before that guidance, the agencies said they "plan to issue in the near future a request for information that addresses model risk management generally and considers, in particular, banks' use of AI, including generative AI and agentic AI and AI-based models."
A request for information is the step before anyone drafts a framework. It asks the industry what belongs in one.
As of 23 August 2026, no such request for information had been published. That is a verified negative rather than an inference, and the verification is reproducible: the Federal Register, queried by agency for the OCC, the Federal Reserve System and the FDIC for documents published on or after 17 April 2026, returns nothing matching a model risk management request for information; the Federal Register's public-inspection list, which shows documents filed but not yet published, contained no OCC, Federal Reserve or FDIC document on AI or model risk; the Federal Reserve's 2026 press releases and its SR letter index show no such letter; and the FDIC's 2026 press releases and Financial Institution Letters run through mid-August with no AI request for information in them. Four months and one week after the promise, the consultation that precedes the framework has not opened.
If that changes tomorrow, the sentence above stays true, because it is dated. But the interval it describes has already happened, and institutions have already deployed inside it.
India. On 24 June 2026 the Reserve Bank issued a draft Guidance on Regulatory Principles for Model Risk Management, addressed across commercial, small finance, payments, regional rural and cooperative banks, to non-banking financial companies, to all-India financial institutions and to asset reconstruction companies. It proposes a board-approved model risk management framework, risk-based tiering across an enterprise model inventory, model override and kill-switch capability, and accountability for third-party models. The comment window closed on 24 July 2026. As of 23 August 2026, no final text had been issued: the Reserve Bank's own notifications and press-release registers, both current through 22 August, carry sanctions updates, lead-bank assignments, priority-sector amendments and housing-finance directions, and no model risk management guidance. Trade press reported in mid-August that a broader AI framework for banks and NBFCs was under deliberation at discussion stage; that report carries no named officials and I treat it as press-sourced deliberation and nothing more.
The Indian sequence, in order: a committee report from a year ago, a draft, a closed consultation, a governor's speech urging acceleration, and a press report of a deliberation. No instrument in force.
The United Arab Emirates. Here I want to be careful, because the easy version of this argument is wrong and any reader inside the system will catch it. A framework does exist. On 18 May 2026 the Cabinet approved an implementation framework for the agentic program, with work teams headed by each minister or head of entity, and with targets and assessment indicators. On 14 June 2026 a Federal Authority for AI and Data was established, reporting directly to Cabinet, consolidating the AI Office, the telecom regulator's information and digital government sector, and the Emirates Data Office, with standard-setting inside its mandate.
The accurate claim is not that nothing was approved. It is about what the approved material addresses. The 18 May framework is an implementation and delivery framework: who leads, what the targets are, how progress is assessed. It does not specify what an agent may decide, what controls apply to an agent action, what must be auditable afterward, or who is accountable when an agent acts wrongly. The standard-setting mandate sits with an authority established two months ago, which means the standard is being written now, against whatever the fifty entities have already built.
The financial-sector instrument nearby is instructive on exactly this point. The UAE central bank's Guidance Note on consumer protection and the responsible adoption of AI and machine learning by licensed financial institutions was issued on 11 February 2026 and announced on 23 February. It is advisory in the strict sense: across its full text it uses "should" roughly seventy times and "must" not once, and both uses of "shall" are structural, one being the clause providing that the Note supplements rather than replaces existing law. It sits in the central bank's rulebook under market conduct and consumer protection, scoped to areas bearing on consumers, and its ten sections run from governance and accountability through human oversight to third-party risk. None specifies what controls apply to an agent's action.
Its seventh section is where the agent question surfaces without being answered. Human oversight, it says, may be exercised through different models, the first being human-in-the-loop, where the system provides recommendations and a human decision maker retains full authority to approve or reject. An agent that completes a transaction is not that model, and the Note does not say which model an agent occupies, because it was not written about agents.
And one more sector, to show it is not a banking artifact. In pharmaceutical and life sciences, the pilots-to-production pivot is now reaching validated manufacturing. The US Food and Drug Administration has issued draft guidance on the use of AI to support regulatory decision-making for drug and biological products, still in draft as of 23 August 2026. It has also issued, jointly with Health Canada and the UK MHRA, guiding principles on good machine learning practice for medical device development. As of 23 August 2026, a Federal Register query of the agency's AI notices returned nothing addressing agentic AI in GxP-validated environments. That is a thinner check than the banking one above, and worth flagging as thinner: the agency's authoritative guidance database was unreachable. Same shape, different regulator, and sharper than it first looks. The instruments that exist sit on the device side rather than the drug side, and none addresses the thing that acts.
Deferral is not exemption
This is the part of the argument that gets read wrong most often, and reading it wrong is expensive in both directions.
The comfortable reading of April 2026 goes like this. Agentic systems are outside the scope of the model risk framework. The guidance says it does not set forth enforceable standards. Therefore the supervisor has declined to have this problem, and an institution may build, monitor sensibly, and wait for a rule.
Two things are wrong with that.
The first is a matter of reading the footnote to its end. The passage that removes generative and agentic models from scope continues, and the continuation points the other way: a banking organization's own risk management and governance practices should guide the determination of appropriate governance and controls for tools, processes or systems not covered by the document. The carve-out does not remove the requirement to determine appropriate governance and controls. It relocates the determination to the institution and declines to specify it.
The language is also interagency, though it is frequently attributed to a single agency. The scope footnote sits in the shared guidance document issued jointly by the Federal Reserve, the FDIC and the OCC, which the Federal Reserve distributes as the attachment to SR 26-2 and the FDIC distributes with its own issuance. Attributing the carve-out to the OCC alone understates its reach in one direction and the accompanying responsibility sentence in the other.
The second thing wrong with the comfortable reading is a matter of what supervisory guidance has ever been. The non-enforceability sentence is real and should not be softened: the guidance says it does not set forth enforceable standards or prescriptive requirements, and that non-compliance will not result in supervisory criticism. But that sentence carries a footnote which, after citing the agencies' rules on the role of supervisory guidance, preserves supervisory action for violations of law or unsafe or unsound practices stemming from insufficient management of model risk. And in US banking, supervisory guidance has never had the force of law in the first place. The 2023 interagency third-party risk guidance says so in terms. The non-enforceability sentence is the standing status of all supervisory guidance, restated. What is new in April 2026 is the scope carve-out, not the non-enforceability, and a control narrative leaning on the second half has misread which half changed.
Now the general point, which travels beyond banking.
Guidance specifies. Obligation attaches to the action. When a supervisor withdraws or defers a specification, the obligations that attach to the underlying action are untouched, because those obligations were never sourced in the specification. A bank that mis-handles a customer's account is answerable under consumer protection law whether or not a model risk framework named the control that would have caught it. A firm that lets a vendor's system make decisions it cannot evidence is answerable under third-party risk expectations that predate every AI instrument in existence. An insurer, a broker-dealer, a manufacturer under quality-system regulation, a licensed financial institution in a jurisdiction whose central bank has issued only guidance: each of them carries duties tied to what the business does, not to how the technology was categorized.
What was removed in April 2026 is the framework that would have told institutions which specific controls satisfy those duties for this class of system. Nobody is going to hand anyone an agent-control specification in the near term. The specification is deferred, the duties are live, and the deferral has a defined consequence that runs in exactly the opposite direction from the comfortable reading.
Consultations are answered by describing what firms already do. A request for information asks the industry what a framework should contain, and the industry answers by describing its current practice. Supervisory examination, when it eventually arrives, is calibrated against observed practice at institutions the supervisor considers well-run. So the control architecture built during a deferral is not a stopgap that a future rule will replace. It is the raw material the future rule will be drafted from, and the benchmark that later arrivals will be measured against.
That makes this a stronger argument for building the governance layer now, not a weaker one. The window in which an institution's own architecture can shape the eventual reference is open precisely because nothing has been published, and it closes when something is.
The market wrote a price before the regulator wrote a rule
While the supervisory rail sat still, the private market did something legible.
On 13 August 2026, Dynatrace announced a definitive agreement to acquire Arize AI, an AI-observability and large-language-model evaluation platform, for $915 million, structured as roughly $815 million in cash plus replacement equity awards. The stated rationale is connecting model evaluation in development with model behavior in production. The company told public investors it expects the deal to be approximately two hundred basis points accretive to ARR growth and about one hundred and seventy-five basis points dilutive to non-GAAP operating margin in fiscal 2027. Those figures are the acquirer's own, published in its press release and investor relations materials.
Read the shape of that transaction rather than its size. A public infrastructure vendor paid roughly a billion dollars for evaluation and AI-behavior validation, and told shareholders that owning the assurance layer accelerates revenue growth. Two smaller data points sit alongside it: a $30 million Series A into AI red-teaming announced on 12 August, and a $125 million Series C into runtime agent security announced on 3 August, outside the fortnight but inside the same month, with corporate strategics among the investors. On 13 August, a data platform closed $5 billion at a $190 billion valuation with proceeds explicitly earmarked for products that help enterprises build and manage agents, disclosing a $7 billion-plus revenue run rate and a database product built for agents at $100 million annualized. Those are company disclosures, reported by three tier-one outlets and consistent across them.
I do not think capital markets are wiser than supervisors. They are faster, and they price residuals. The residual an enterprise carries when it runs agents against supervised workloads is the assurance layer. Somebody put $915 million on it in the same week a government ordered half its operations onto agents and a banking supervisor's consultation stayed unopened.
A note on my own specification, since I am arguing that specifications matter
I have built an authority-and-evidence layer for agent systems. Parts of it run. Parts are specified and not yet built, and I mark which is which whenever I write about it, because the whole argument I am making collapses if I describe an intention as a capability.
In June I wrote a design document for the credential path. It said that credentials issued to agents expire after fifteen minutes. I wrote that line without thinking about it, the way everybody writes token lifetimes. Fifteen felt short enough to be responsible and long enough not to cause operational pain. It sat in the document for weeks looking like a security control.
A reviewer asked me what the fifteen was for.
I did not have an answer. And once the question is asked properly, the number changes character completely. A token lifetime is not a security control. It is a decision about how long an agent may keep acting after the moment you decided it should stop. Fifteen minutes is not caution. It is a commitment to permit fifteen minutes of further action after revocation, and in a system that acts at machine rate, the relevant question is not how many minutes but how many actions. Revocation is a service-level objective about stopping, and I had written it as a time-to-live because that is the field the library exposes.
I tell that story because it is the small version of the large one. When nobody has published a control specification, the specifications that exist are the ones practitioners wrote without being examined on them. Some are good. Mine was not, until somebody asked. The industry is writing thousands of such lines into production systems inside regulated functions, and the first serious examination of most will be a supervisor's, not a reviewer's.
What this means if you are deploying now
Not advice about whether to deploy; that decision has been made above your head in most organizations reading this. What follows is what I would want to be able to produce in a jurisdiction where the instrument has not landed.
Treat delegation as an object, not as context. In the prevailing pattern, authority moves between agents as ambient state: a shared session, an inherited credential, a system prompt carried forward. None of those is an event, so none leaves a record of the form your control framework knows how to evidence. Every other control in a regulated firm is built out of request, approval and record. Agent handoffs produce none of the three. If you can point at a delegation object with a parent, a scope narrower than its parent's, an expiry and a purpose, you can answer questions later. If you cannot, you will be answering with a paragraph in a control narrative asserting that the service acts on somebody's authority, which is an assertion rather than evidence.
Write revocation as a stopping objective. How long, in actions rather than minutes, can this system keep acting after a human decides it should not? Measure it. It is almost always longer than the token lifetime suggests, because caches, in-flight work and queued tasks all extend it.
Keep an inventory that maps activity to a named person. The Indian draft asks for an enterprise model inventory, and governance expectations in this domain consistently expect a named individual responsible for activities across a lifecycle. A chain in which every hop runs as the same service principal collapses that mapping to a constant, which is the same as having no mapping.
Record which oversight posture each agent actually occupies, and test the claim. Human in the loop, on the loop, and out of the loop are three different control environments. An agent that completes a transaction is not in the posture of one that drafts a transaction for review, even when the architecture diagram draws them identically.
Keep a dated register of the instruments you are building against, with the status of each. Not because it is impressive, but because half of what practitioners cite in this field is superseded. Anyone still citing SR 11-7 as current guidance in a 2026 control narrative is citing a document that was superseded on 17 April 2026, and that error is checkable in one click by exactly the reader whose opinion matters.
What would make this argument wrong
I will state the conditions plainly, because an argument that cannot be falsified is a marketing position.
The request for information publishes with a full control specification. If the agencies open the consultation and it arrives carrying detailed prescriptive expectations for agentic systems rather than open questions, then the deferral was a scheduling matter and the window I am describing was an administrative delay of a few months. I do not expect this, because a request for information is by construction a set of questions, but it is the cleanest possible refutation and I would rather name it than have it named for me.
The obligations turn out not to survive. If a supervisor or a court holds that the scope carve-out relieves institutions of duties attaching to the underlying action, the central claim of this piece fails. I have seen no such holding. The guidance's own footnote points the other way, as does the standing status of supervisory guidance generally. But this is the load-bearing legal claim and it deserves to be held to.
The deployments turn out not to be what the disclosures say. Every bank figure here is self-reported and press-aggregated, and every vendor adoption metric is vendor-published. If the production reality behind those numbers is narrower than the announcements suggest, the gap between adoption and specification is smaller than I have described. One honest counterweight sits in the same evidence base: an August analysis reported that only about ten percent of financial institutions have deployed agents at scale. That number and the Wall Street ledger are both true, and the distance between them is the actual state of the market.
Somebody publishes the specification first. Standards bodies, industry consortia and individual supervisors could each produce a workable control specification for agent authority before any banking supervisor does. If that happens, the reference gets set by them rather than by deployed practice, and the argument about who writes the eventual rule changes hands. Europe's regime runs on a different timetable and is not the reference I would build against for a US, Gulf or Indian institution.
The window closes and nobody used it. This is the outcome I consider most likely and least discussed. Deferral creates an opportunity to shape the eventual reference only for institutions that build something worth referencing. An organization treating the silence as permission to defer its own work gets no benefit from the drafting window. It just gets examined later against somebody else's architecture.
The read
A government ordered half its operations onto agents on a two-year clock, and its control specification is being written now by an authority two months old. A central bank governor told his industry to accelerate while his own draft model risk guidance sat past its comment deadline unfinished. The largest banks in the world disclosed agents in production against trade accounting and client onboarding, in a country where the consultation preceding any AI-specific supervisory framework had not opened four months and a week after it was promised, verified against the register on 23 August 2026. A public company paid $915 million for the layer that would evidence any of it.
That is not a story about regulators being slow. Deferral in April 2026 was a deliberate and defensible choice: the agencies said the technology is novel and rapidly evolving, and writing a control framework for a moving target produces a bad framework. The consequence is simply not the one the comfortable reading assumes. Nobody is coming with the specification in the near term, the duties attached to the underlying actions never went anywhere, and the institutions building carefully in the interval are writing the draft that the eventual instrument will be tested against.
If you are deploying inside a deferral and disagree with any of the five falsification conditions above, I would rather hear it than not.