In September, the legal department of a large group asked me to scope a corporate law tracking agent: a calendar of deadlines, up-to-date templates, checklists, a completeness check before filings. Before even talking about tools, the lead lawyer set one condition: systematic human validation, hers.
She did not distrust AI. She simply knew that if a filing went wrong, her name would be on the line. She wanted accountability to stay visible.
Many companies have not had that reflex.
What the Deloitte study shows
On 29 October, the Deloitte AI Institute published its survey The State of AI in the Enterprise, based on 3,500 executives in 25 countries. Three figures deserve an executive committee's attention.
- 40% of companies already let AI execute decisions without human approval, at least to some extent.
- 23% say accountability remains unclear when an AI system produces a bad outcome.
- Only 15% report a significant shift in decision-making authority linked to AI.
Read together, these figures describe a gap. AI already acts, but the organisation has not moved. Decisions change hands without roles, delegations and approval circuits being reviewed.
The study also shows that usage is growing: 81% of companies say they decide and execute faster, and 28% report revenue gains from AI, up from 20% in January. So the question is not whether to slow down. It is who owns what has been delegated.
Why the question is arising now
For two years, generative AI mostly drafted, summarised and suggested. A human reviewed before sending. Accountability naturally stayed with that person.
Agents change the picture. They arrive in the tools companies already pay for, and they act: updating a record, routing a request, triggering a reminder, preparing a payment. Some run without a human stepping in at each stage.
Security teams see it coming. According to the Okta Global CISO Insights 2026 study, cited by Journal du Net on 19 October, 81% of security leaders are concerned about excessive access granted to AI, but only 47% say they can identify every agent in their environment.
An agent nobody can list is an agent nobody answers for.
Three levels of delegation, three levels of control
Not all decisions are equal. I suggest business leaders place each use case in one of three levels.
Level 1. AI informs. It summarises, alerts, prepares a briefing. The human decides and acts. Control focuses on the quality of information. Example: an alert on a contract deadline.
Level 2. AI proposes. It prepares a complete decision, which a human approves before execution. Control focuses on approval: who approves, how quickly, with what right to refuse. Example: a draft reply to a customer complaint.
Level 3. AI executes. It acts alone, within set limits. Control focuses on the limits and the audit trail. Example: automatically routing incoming requests to the right team.
Moving from one level to the next is a leadership decision, not a technical setting. That is where accountability is decided.
A simple rule: one named owner per delegated decision
For every level 2 or level 3 use case, a one-page sheet is enough. It answers six questions.
- Which decision is delegated, in one sentence?
- Who answers for it: a named person, in the business, not « IT » or « the project »?
- What limits: amount, scope, type of case, beyond which a human takes back control?
- What trail: where can you find what the AI did, and why?
- What warning signal: which incident sends the use case back down a level?
- What review: when, and by whom, is the delegation reassessed?
The sheet serves three functions at once. Legal finds the chain of accountability. Finance finds the commitment limits. IT finds the inventory of agents and their access rights.
What the law already requires
The EU AI Act does not regulate agents as a category, as Journal du Net points out. It does require organisations to be able to identify, supervise and control the systems they deploy, depending on their risk level.
For high-risk systems, the text provides for human oversight (Article 14) and obligations for the organisations that deploy them (Article 26). According to an opinion piece published by Maddyness on 28 October, the so-called Omnibus revision postponed most of this chapter to 2 December 2027.
This delay is an opportunity. It leaves time to build delegation rules that serve the business first, before they become a compliance obligation.
Where to start
If you do only one thing this month: ask each department for the list of use cases where AI acts without approval, even partially. For each one, ask a single question: who answers for it?
The use cases without an answer are your priority. They are not necessarily the riskiest, but they are the ones where nobody will see the problem coming.
The lawyer who insisted on her validation did not slow the project down. She made it possible, because everyone knew who held the decision.
I build these delegation rules with business leaders, legal and IT, from the inventory to the review. Let’s talk about your use cases.
Sources
- Enterprise AI Enters an ROI Reckoning: More Use, Uneven Value, Deloitte AI Institute, 29 October 2026
- AI Act : les entreprises ont-elles encore le temps de préparer la gouvernance de leurs agents IA ?, Journal du Net, 19 October 2026
- Formation IA en entreprise : les exigences de l'AI Act, Maddyness, 28 October 2026