Two emails, word for word identical, both written by AI. A claims handler sends the first after reading it. The AI sends the second itself. For the customer there is no difference. For governance there are two worlds.
With these two emails I opened my talk at KI KONNEX 2026, the AI summit for the insurance industry that V.E.R.S. Leipzig held in Cologne on 3 and 4 November. I previewed the argument here in October. The talk took the seven building blocks from my talk in the V.E.R.S. AI network in May and asked what each of them needs once AI acts. These notes record where it ended up.
An agent is an AI system that acts
Both emails come from the same kind of system: a language model drafting a reply to a claim. What differs is the last step. In the first case a person reads the draft, perhaps adjusts a deadline, and clicks send. In the second nobody clicks. The AI decides that the email goes out.
That gives a simple definition. An AI agent is an AI system that carries out an action itself — an action that writes to the world, such as sending an email, opening a ticket or changing a record. Drafting, researching and summarising are not actions in this sense, however much work the AI does. As long as a person carries out the action, we have an AI system, but not an agent. A chat assistant such as our in-house KammerGPT is therefore not an agent, however capable it is.
The European Commission starts from the same place. Its AI Act Service Desk states that AI agents are not a separate category under the AI Act: they fall under the existing definitions, and the same rules apply. The question is therefore not whether the AI Act covers agents. It is how to govern what they do.
Two axes: the purpose, and every single action
The first axis is familiar: the risk classes of the AI Act, which ask what a system is for. For insurers, high-risk chiefly means risk assessment and pricing for natural persons in life and health insurance (Annex III, point 5(c)). That axis applies to agents exactly as it does to any other AI system.
For agents it is not enough. An agent with minimal risk under the AI Act can still do real damage — by sending a cancellation, for instance. So there is a second axis: the action, and every action on its own. Three questions decide it. Who is the addressee? Can the action be undone? And how large is the damage if it is wrong?
They lead to three classes. An action is free when its effect lands with a person who then decides: an internal email to a colleague, a ticket that a colleague works on. If something is wrong, a person catches it. An action needs approval when its effect leaves the company or runs into an automation: the email to the customer, or an email to a mailbox that a machine processes. An employee then releases each action individually. With that release, the agent’s action becomes a human decision again — exactly as with the first email. Some actions are not available in self-service at all: a cover confirmation from the chatbot, a large claims payment, sending a cancellation. They go through case-by-case review.
Autonomy is therefore granted per action, not per agent. The same agent may inform colleagues freely and still need a person’s approval before anything reaches a customer.
A rule in the prompt is a request
An agent reads a policy faster than any person. Whether it complies cannot be guaranteed. The boundaries therefore have to be enforced technically, by the platform on which employees assemble their own agents, at four points.
First, self-service agents run only on agentic platforms that have themselves been reviewed. Second, the platform offers only the write-capable tools listed in an interface catalogue, each with its action class: it holds actions that need approval until a person agrees, and what is blocked is simply not on offer. Third, every agent has its own identity in identity and access management, with minimal rights and never more than the person who owns it. Fourth, the platform logs every action, tamper-proof, at the level of actions rather than prompts. What counts is what the agent did, not what someone asked it.
The register is the precondition for all of this. No register entry, no agent: an agent that is not registered must not run. For agents, the register also records whether one runs in self-service or through case-by-case review, which tools it uses and whom its actions address. A new tool or a wider circle of addressees triggers reclassification. That is an observable trigger, so nobody has to guess whether something material has changed.
Governance sets the pace
Case-by-case review is thorough, and for the second email it remains the right route. But it does not scale. Once employees can assemble agents themselves, they arrive in numbers no review board can process one at a time.
The model therefore moves the review. The platform is reviewed once, the interface catalogue is maintained, and logging is in place. After that, agents scale. Self-service applies whenever every action an agent needs is classed as free or as requiring approval; otherwise the agent takes the classic route. Review capacity concentrates on the few cases that need it.
Two principles from May carry over. The first is to integrate rather than duplicate. Every AI agent is also an ICT asset, so the existing ICT risk management, internal control system and group risk management absorb what is specific to AI — for agents above all prompt injection, memory and context poisoning, and tool misuse. The second is clear responsibility. The deployer is the insurer, not the employee who built the agent; a business unit answers for every agent; and employees in self-service become the people who release their agents’ actions.
Governance sets the pace not because it reviews faster, but because it makes most reviews unnecessary.
What is still open
Four questions remain, and I said so in Cologne.
The first is downstream automation. An agent may send an internal email freely. But if a software robot or another agent sits behind that mailbox and forwards emails externally, the agent has acted outside its class by a detour. The standard is clear: what counts is the whole chain of effects, not the first recipient. How the platform learns what sits behind a mailbox is not.
The second is identity. Most identity and access management systems are not yet built to treat agents as identities with rights of their own.
The third is behavioural drift. New tools and new addressees can be detected. An agent’s behaviour can also change without anyone touching its configuration, for example through an update of the underlying model.
The fourth is that regulation lags behind. The Commission describes its regulatory considerations on agents as only preliminary at this stage. Whoever implements now works with their own interpretation, and should document it — which is also what makes it evidence when something goes wrong.
Whether a customer’s email is released by a person or sent by an agent is not decided by technology. It is decided by design. And whoever decides it early lets their agents run sooner.
Note & sources
These notes are based on my talk ‘Wenn Agenten selbst handeln: KI-Governance als Designprinzip’ at KI KONNEX 2026, the AI summit for insurers of V.E.R.S. Leipzig, at the smartvillage in Cologne-Mülheim on 4 November 2026, moderated by Prof. Dr. Fred Wagner. I previewed the talk in October; it builds on my talk ‘Effektive KI-Governance’ in the V.E.R.S. Leipzig AI network for the insurance industry on 18 May 2026.
- KI KONNEX 2026 — the AI summit for insurers, V.E.R.S. Leipzig, 3–4 November 2026.
- Regulation (EU) 2024/1689 (AI Act): Article 3(1) on the definition of an AI system; Annex III, point 5(c) on risk assessment and pricing in life and health insurance.
- European Commission, AI Act Service Desk, ‘How are AI agents addressed within the AI Act?’, accessed 2 November 2026.