Jillian Bommarito (273 Ventures) et al. have posted “Governing AI Agents: Risk, Compliance, and Accountability in Law and Finance” on SSRN. Here is the abstract:
Agentic AI systems—capable of autonomous goal pursuit, environmental perception, and iterative action—are rapidly entering legal and financial services, yet existing governance frameworks were not designed for software that acts rather than merely responds. Unlike passive AI tools, agentic systems can stray from their intended objectives and take consequential actions without human approval, creating risks that traditional compliance models often fail to address. This chapter proposes a governance framework that can be used to scale oversight requirements to match each system’s risk profile, based on factors like degree of autonomy, how long it operates, whose interests it serves, and how its objectives are set and modified. The framework situates agentic AI within a five-layer regulatory stack encompassing foundational law, professional ethics, sector-specific regulation, emerging AI-specific rules (including the EU AI Act), and voluntary assurance standards such as NIST and SOC 2.
The chapter argues that in law and finance—industries built on trust and non-delegable professional duties—human-in-the-loop and human-in-command architectures are not merely best practices but critical designs for satisfying fiduciary and regulatory obligations. To operationalize accountability without fragmenting ownership, the chapter evaluates three organizational models—centralized, federated, and embedded—and demonstrates how responsibility-assignment tools such as RACI matrices can allocate oversight duties with precision. It concludes by outlining a maturity-based adoption path that enables legal and financial institutions to adopt agentic AI while managing liability exposure and reputational risk.