Agentic AI: Building trust and envisioning the future

In agentic AI, regulatory maturity is becoming a competitive differentiator, not a cost of entry.

In agentic AI, trust is no longer a supporting consideration—it is the primary determinant of whether organisations can scale, monetise and compete. As AI agents move from experimentation into autonomous decision‑making, delegated authority and cross‑system execution, regulatory maturity is rapidly becoming a competitive differentiator rather than a cost of entry.

Organisations that embed trust, transparency and accountability into the foundation of their agentic AI strategies are accelerating innovation with confidence. Those that do not are finding their ambitions constrained by regulatory scrutiny, operational friction and growing stakeholder scepticism.

Why regulatory maturity matters now

Momentum behind agentic AI is building quickly, reshaping how organisations access, manage and measure AI capabilities. Yet the ability to translate this momentum into measurable value at scale remains limited.

KPMG’s Global AI Quarterly Pulse Survey Q2 2026 highlights that while investment and intent are high, most organisations remain early in their AI journey, citing data security/privacy/risk concerns and pressures to demonstrate value as key factors influencing their AI Strategy with responsible AI and governance considered a key AI priority for organisations.

In an environment defined by heightened enforcement, evolving interpretation of regulation and landmark legal cases, launching an agentic AI strategy is no longer just a question of technology or operating model design.

Compliance at the core of strategy

Enterprise adoption now depends on trust by design— where regulatory compliance, risk management and governance are embedded end‑to‑end to enable scale, protect value and sustain credibility.

Organisations considering capitalising on this opportunity in the design, development and implementation of an agentic AI strategy should be placing their global regulatory compliance obligations as part of the core foundation of their strategy.

By embedding regulatory compliance across the entire agentic AI strategy, organisations can accelerate innovation while maintaining control, credibility and regulatory confidence.

Most organisations are transnational, and dynamic, often triggering overlapping and sometimes conflicting regulatory requirements simultaneously as they scale. Without early planning, differing national regulations can create friction, slow expansion and force costly compliance changes later.

The journey

The KPMG agentic AI regulatory compliance journey is conducted across four stages:

1. Assess
2. Design
3. Deliver
4. Monitor

Launching an agentic AI strategy that operates across the globe requires organisations to understand the compliance implementation effort required across the markets that your organisation’s agentic AI strategy will operate in.

In assessing your organisation’s regulatory landscape, it is crucial to gain an understanding of the breadth and depth of compliance requirements, how they differ across regions, where synergies can be leveraged and the cost of not getting this right from the outset.

In understanding the compliance implementation effort required, KPMG can facilitate supporting your organisation in completing a regulatory readiness assessment.

This includes the assessment of your current position versus the future position of your organisation in terms of regulatory compliance, identifying gaps in compliance to determine regulatory readiness and support your organisation in sizing, prioritising and planning for the design, development and deployment of an agentic AI strategy in the context of your short, medium and long-term objectives.

During the design stage of an agentic AI strategy, it is critical that organisations mobilise a programme that focuses on how regulatory compliance is going to be implemented across every layer of agentic AI activity.

For example, the design or refresh of AI, governance, risk and control frameworks, the design of a Target Operating Model (“TOM”), embedding agentic AI compliance as part of your organisation’s existing compliance function or standing up a new compliance function.

KPMG can support your organisation in designing and uplifting your governance, risk and internal control frameworks to support your organisation in the documentation of risks, controls, and governance structures to ensure that there are robust procedures for your agentic AI strategy.

As part of the delivery stage, the organisational focus will turn to implementing any regulatory compliance gaps identified as part of the Assess stage and bringing the future position to life.

Leaders in the agentic AI market are embedding pre-approval requirements prior to offering agents developed by third party partners on their marketplaces supported by clear quality standard and built-in compliance checks.

It is imperative to entrench security, monitoring and logging as part of the core architecture to enable organisations to see what agents are executing in real time, detect risks early and meet audit requirements.

Leaders must ensure there is ongoing testing, human approval, and flexible safety controls to ensure agents remain safe, transparent and accountable as they evolve.

KPMG can work with your organisation to develop a global regulatory playbook for your organisation’s agentic AI activity assessing regulatory impact across jurisdictions to establish a globally consistent approach.

Organisations must continuously monitor and ensure ongoing compliance across the regulatory landscape once the agentic AI strategy becomes operational.

Failure to embed and monitor regulatory compliance across your organisation’s agentic AI operationalisation is not just a legal risk but a business-existential risk that can compound across jurisdictions over time.

The impact of not adhering to regulatory requirements can be severe, multi-dimensional and long lasting. Competitors leading from the front with strong compliance, embracing the spirit of regulations and not just engaging in tick box exercises that can respond to enforcement guidance and case law as it matures and continues to evolve can position themselves favourably with regulators and maintain consumer trust.

KPMG can support your organisation in the ongoing assessment of your governance, risk and internal control frameworks.

Non-compliance

Organisations are operating in an era of dynamic enforcement, regulatory interpretation through action, and compliance recalibration—where the rules are known, but their practical boundaries are continuously redrawn through investigations and fines.

Success depends not only on compliance but also on resilience, foresight, and the ability to respond as regulatory expectations evolve in real time. Below outlines some of the impacts that organisations face for non-compliance.

North America
- Landmark legal cases resulting in millions in damages for addictive design
- Billions in penalties for misuse of user data
Europe
- Fines up to €35 million or up to 7% of total worldwide annual turnover for non-compliance with the EU AI Act
- Fines up to €20 million or 4% of total worldwide annual turnover for non-compliance with GDPR
- Fines up to 20% of total worldwide annual turnover for non-compliance with the Digital Markets Act

The cost of retrofitting compliance

Regulatory fines and penalties

Organisations could face significant fines and penalties. For example, non-compliance with the

EU AI Act can result in fines up to €35m or 7% of total worldwide annual turnover.
Enforcement and remediation costs

Organisations could be exposed to enforcement and remediation costs with mandatory remediation programmes and engaging external legal counsel, consultants and auditors.
Business disruption

Regulators may enforce suspension of activities or disablement of features resulting in loss of revenue, weaker market positioning, disruption to customers and an inability to scale.
Litigation exposure

Failure to embed regulatory compliance can give rise to lawsuits from customers, employees, partners or shareholders generating legal and settlement costs.
Loss of consumer trust

In an era where consumers are demanding accountability, an inability to comply with regulatory requirements generates a loss of consumer trust risking a long-term loss of organisational credibility.
Competitive disadvantage

Non-compliance with regulatory requirements can result in reputational damage and a long-term loss of consumer trust positioning organisations in a negative light with regulators and consumers alike.

How KPMG can help

As organisations accelerate their adoption of agentic AI and explore designing, developing and implementing agentic AI strategy, they face a common set of challenges, from defining strategic ambition to navigating regulatory complexity, designing scalable operating models, and maintaining global consistency.

KPMG supports clients through this journey end‑to‑end, combining strategic insight, market analysis, regulatory expertise, and target operating models to support your organisation in envisioning a future and building a sustainable, trusted, competitive agentic AI strategy

Regulation

Agentic AI regulatory readiness assessment

KPMG supports organisations in completing regulatory readiness assessments, assessing the organisation’s current position versus future regulatory compliance position, identifying gaps and prioritising actions aligned to organisational objectives.
Agentic AI global regulatory playbook

KPMG works with organisations to design global regulatory playbooks for assessing the regulatory impact for organisation’s agentic AI strategy.

Execution

Framework design and implementation

Our team supports organisations in designing and refreshing governance, risk and internal control frameworks to establish robust procedures for agentic AI.