Organisations deploying autonomous AI agents will need to rethink their approach to AI governance, according to OneTrust’s 2027 Predictions Report, which warns that one-off approvals will not keep pace with fast-changing AI capabilities.
Key Takeaways
- OneTrust’s report draws on insights from more than 20 global experts and sets out four predictions for 2027.
- 87% of respondents say their organisations encourage AI agent use, but only 47% report clear governance, oversight and controls.
- Technical access does not equal authority: agents need defined boundaries, monitoring and intervention processes.
Four predictions for AI governance in 2027
OneTrust, the AI-Ready Governance Platform™, released Architecting AI Governance: Blueprints for a Moving Maze, outlining how organisations must adapt as AI becomes more autonomous and embedded in business operations.
- AI assurance becomes a commercial gate: Buyers will increasingly expect current, relevant evidence that AI systems meet assurance requirements before agreeing to activate or expand their capabilities.
- Approved agents can still act without authority: Organisations will need clearer boundaries around delegated authority, alongside effective monitoring and intervention processes.
- Material AI changes trigger new assurance events: Changes to an AI system’s capabilities, permissions or operating conditions will require organisations to reassess whether existing approvals and evidence remain valid.
- Data-use permissions join AI governance: Customer choices about how their data is used must be reflected in later AI processing, rather than treated as an all-access pass.
AI agent adoption outpaces oversight
The need for stronger oversight is already emerging. OneTrust’s 2026 AI-Ready Governance Report found that 87% of respondents say their organisations encourage AI agent use. However, only 47% report having clear governance, oversight and controls in place, while a further 40% say these capabilities are still developing.
Access is not the same as authority
Arran Mulvaney, Regional Director, ASEAN and India at OneTrust, said the region’s push for productivity gains makes the issue pressing for Singapore-based organisations.
“Having the technical ability to access information or carry out a task does not mean an AI agent should automatically have the authority to do so,” said Arran Mulvaney, Regional Director, ASEAN and India at OneTrust. “Businesses need clear boundaries around what these systems are permitted to do, ongoing oversight of their actions and the ability to reassess approvals as their capabilities change.”
He added that getting this right will be critical to scaling AI responsibly while maintaining the trust of customers, employees and business partners in 2027.
The report also challenges the assumption that more headcount or static governance policies will be enough to manage increasingly autonomous AI systems. Instead, it calls for adaptable governance models that can respond as technology, use cases and operating conditions change.
