Their limitation is the same feature that makes them manageable: they are usually designed for a defined task. A fraud model may score transactions without being able to explain a policy document, write a report or adapt flexibly to an unfamiliar situation. Performance also depends on the quality of the training data and on what the system was optimised to predict.

That creates important ethical concerns in areas such as credit, hiring, insurance and healthcare. Historical data can reproduce social bias, while opaque scoring systems can make decisions difficult to challenge. Governance therefore needs to include a clearly defined purpose, accuracy and fairness testing across relevant groups, privacy protections, explanations and human review for high-impact decisions. Concerns about bias, misinformation and misuse remain broader AI policy issues, not only problems associated with chatbots.

2. Generative AI: from predicting labels to creating content

Generative AI changes the user experience from “Which category does this belong to?” to “Create or transform something in response to this instruction.” Large models can produce plausible text, images, audio and code, supporting uses such as customer-service drafting, translation, tutoring, legal-material summarisation, software assistance and creative work.

Generative systems can reduce the time and cost of producing a first draft, provide a conversational interface to complex information and help people work with content in new formats. They can also augment professionals rather than simply automate a fixed decision.

The central weakness: plausible does not mean true

A generative model can produce a confident but fabricated or inaccurate statement, source, legal authority, medical claim or piece of code. NIST uses the term confabulation for “the production of confidently stated but erroneous or false content,” commonly called hallucination.

This makes verification essential wherever factual accuracy matters. Useful safeguards include retrieval from trusted material, citations, structured evaluation, domain-specific testing and qualified human review. A fluent answer should be treated as a draft or prediction—not as proof that the underlying claim is correct.

The wider risks of generative systems

Generative AI also raises questions about data protection, intellectual property, misinformation and the provenance of outputs. European Commission guidance for research highlights these risks and stresses that people remain responsible for the work they publish, even when AI assisted with it.

Education presents a related problem. If students routinely outsource writing, reasoning and problem-solving, they may get a polished result while practising the underlying skills less often. Education guidance identifies inaccurate or biased content, harmful material, data breaches, intellectual-property infringement and academic-integrity challenges as risks that institutions need to manage.

Safety failures can be more serious in sensitive conversations. Generative systems may produce hateful, violent, sexual or manipulative material, or respond poorly to someone expressing self-harm intent. NIST identifies dangerous or violent recommendations, privacy and harmful bias among the risks that need to be addressed. In high-risk settings, AI should not replace qualified care or human safeguarding. Systems need strong refusal and escalation behaviour, privacy controls and a clear route to immediate human support.

3. Agentic AI: planning, using tools and taking action

Agentic AI adds an action loop around a model. Rather than responding once to a prompt, an agent can interpret a goal, break it into steps, call tools such as a browser, code runner, email service or API, inspect the results, revise its plan and continue.

Stanford describes agentic AI as autonomous or semi-autonomous systems that can interpret goals, sequence actions, use tools, respond to feedback and adapt to complete tasks within defined constraints.

The practical difference is significant:

• a predictive system scores a transaction;
• a generative system drafts a response about it; and
• an agent could, if given the necessary access, investigate the transaction, update a case file and send a message.

Google’s Jules illustrates the software-development use case. Google describes it as an asynchronous coding agent that integrates with repositories, clones a codebase into a cloud virtual machine and works on coding tasks for later review. Open-source tool-using agents represent another approach, while recruiting products such as LinkedIn’s Hiring Assistant show how agentic workflows can extend into sourcing and hiring.

Agents are attractive because they can complete multi-stage work instead of merely suggesting the next step. A coding agent might investigate a bug, edit several files, run tests and prepare a pull request. A workflow agent might gather information, organise it and prepare communications for approval.

Why autonomy increases the risk

Planning is not the same as reliable understanding. An agent can misunderstand a webpage, choose a poor plan, follow a malicious instruction or compound a small error over many steps. The 2026 Stanford AI Index reports that agents improved from 12% to about 66% task success on OSWorld, a benchmark of real computer tasks, but still failed roughly one in three attempts.

A chatbot’s hallucination may remain a communication problem. An agent with credentials, browser access or payment authority can turn the same kind of error into an external action. That is why agentic governance must address not only output quality, but also permissions, reversibility and accountability.

The main safety risks for AI agents

The most important risks arise where an agent can affect systems, money, data or other people:

• Unauthorised payments: An agent could select the wrong item, exceed a budget or be manipulated by a malicious webpage.
• Privacy leakage and data theft: Access to email, files, customer records, source code or API keys creates opportunities for disclosure, especially through prompt injection.
• Security and software damage: An agent may introduce insecure code, change configurations, delete resources or expose secrets through logs and external tools.
• Accountability gaps: Responsibility can be unclear between the model provider, application developer, deploying organisation, tool provider and user.
• Manipulation: Persistent, conversational agents may exert undue influence, particularly when users are vulnerable or the system appears more capable and trustworthy than it is.

What responsible governance looks like

The appropriate controls should match the system’s capability and the consequences of failure.

For predictive AI, organisations should define the purpose, measure accuracy and fairness, protect personal data and provide ways to explain or contest high-impact outcomes.

For generative AI, they should verify important claims, test for hallucinations and harmful outputs, control sensitive data, address provenance and intellectual-property questions, and keep qualified people responsible for legal, medical, financial and safeguarding decisions.

For agents, technical and organisational controls need to go further:

1. Bound the use case. Decide what the agent may and may not do before deployment.
2. Limit access. Use least-privilege credentials, restricted tools, transaction limits and sandboxed environments.
3. Require approval at meaningful checkpoints. Financial, legal, privacy and safety-sensitive actions should not happen without appropriate human authorisation.
4. Make activity auditable. Keep logs, monitor behaviour and assign clear ownership for incidents.
5. Test adversarially. Evaluate prompt injection, data exfiltration, harmful behaviour and failure recovery before and during deployment.
6. Preserve human control. People should be able to stop, override and challenge consequential actions.

Singapore’s Infocomm Media Development Authority sets out this risk-based approach in its Model AI Governance Framework for Agentic AI, which is intended for organisations developing agents internally or deploying third-party solutions. The framework’s central lesson is to graduate autonomy: begin with read-only assistance, move to low-risk actions, and reserve irreversible or high-impact actions for explicit approval.

The direction of travel

The evolution of AI is best understood as an expanding capability stack rather than three completely separate eras. Traditional systems predict and classify. Generative systems create and transform. Agentic systems add planning, tool use and action.

Governance must expand at the same pace. Accuracy and fairness controls remain necessary, but they are no longer enough. Generative systems require strong verification, provenance and content-safety practices. Agents additionally require permission boundaries, action checkpoints, security monitoring and clear accountability.

The more an AI system can do on its own, the more carefully organisations must decide what it is allowed to do.

Their limitation is the same feature that makes them manageable: they are usually designed for a defined task. A fraud model may score transactions without being able to explain a policy document, write a report or adapt flexibly to an unfamiliar situation. Performance also depends on the quality of the training data and on what the system was optimised to predict.

That creates important ethical concerns in areas such as credit, hiring, insurance and healthcare. Historical data can reproduce social bias, while opaque scoring systems can make decisions difficult to challenge. Governance therefore needs to include a clearly defined purpose, accuracy and fairness testing across relevant groups, privacy protections, explanations and human review for high-impact decisions. Concerns about bias, misinformation and misuse remain broader AI policy issues, not only problems associated with chatbots.

2. Generative AI: from predicting labels to creating content

Generative AI changes the user experience from “Which category does this belong to?” to “Create or transform something in response to this instruction.” Large models can produce plausible text, images, audio and code, supporting uses such as customer-service drafting, translation, tutoring, legal-material summarisation, software assistance and creative work.

Generative systems can reduce the time and cost of producing a first draft, provide a conversational interface to complex information and help people work with content in new formats. They can also augment professionals rather than simply automate a fixed decision.

The central weakness: plausible does not mean true

A generative model can produce a confident but fabricated or inaccurate statement, source, legal authority, medical claim or piece of code. NIST uses the term confabulation for “the production of confidently stated but erroneous or false content,” commonly called hallucination.

This makes verification essential wherever factual accuracy matters. Useful safeguards include retrieval from trusted material, citations, structured evaluation, domain-specific testing and qualified human review. A fluent answer should be treated as a draft or prediction—not as proof that the underlying claim is correct.

The wider risks of generative systems

Generative AI also raises questions about data protection, intellectual property, misinformation and the provenance of outputs. European Commission guidance for research highlights these risks and stresses that people remain responsible for the work they publish, even when AI assisted with it.

Education presents a related problem. If students routinely outsource writing, reasoning and problem-solving, they may get a polished result while practising the underlying skills less often. Education guidance identifies inaccurate or biased content, harmful material, data breaches, intellectual-property infringement and academic-integrity challenges as risks that institutions need to manage.

Safety failures can be more serious in sensitive conversations. Generative systems may produce hateful, violent, sexual or manipulative material, or respond poorly to someone expressing self-harm intent. NIST identifies dangerous or violent recommendations, privacy and harmful bias among the risks that need to be addressed. In high-risk settings, AI should not replace qualified care or human safeguarding. Systems need strong refusal and escalation behaviour, privacy controls and a clear route to immediate human support.

3. Agentic AI: planning, using tools and taking action

Agentic AI adds an action loop around a model. Rather than responding once to a prompt, an agent can interpret a goal, break it into steps, call tools such as a browser, code runner, email service or API, inspect the results, revise its plan and continue.

Stanford describes agentic AI as autonomous or semi-autonomous systems that can interpret goals, sequence actions, use tools, respond to feedback and adapt to complete tasks within defined constraints.

The practical difference is significant:

• a predictive system scores a transaction;
• a generative system drafts a response about it; and
• an agent could, if given the necessary access, investigate the transaction, update a case file and send a message.

Google’s Jules illustrates the software-development use case. Google describes it as an asynchronous coding agent that integrates with repositories, clones a codebase into a cloud virtual machine and works on coding tasks for later review. Open-source tool-using agents represent another approach, while recruiting products such as LinkedIn’s Hiring Assistant show how agentic workflows can extend into sourcing and hiring.

Agents are attractive because they can complete multi-stage work instead of merely suggesting the next step. A coding agent might investigate a bug, edit several files, run tests and prepare a pull request. A workflow agent might gather information, organise it and prepare communications for approval.

Why autonomy increases the risk

Planning is not the same as reliable understanding. An agent can misunderstand a webpage, choose a poor plan, follow a malicious instruction or compound a small error over many steps. The 2026 Stanford AI Index reports that agents improved from 12% to about 66% task success on OSWorld, a benchmark of real computer tasks, but still failed roughly one in three attempts.

A chatbot’s hallucination may remain a communication problem. An agent with credentials, browser access or payment authority can turn the same kind of error into an external action. That is why agentic governance must address not only output quality, but also permissions, reversibility and accountability.

The main safety risks for AI agents

The most important risks arise where an agent can affect systems, money, data or other people:

• Unauthorised payments: An agent could select the wrong item, exceed a budget or be manipulated by a malicious webpage.
• Privacy leakage and data theft: Access to email, files, customer records, source code or API keys creates opportunities for disclosure, especially through prompt injection.
• Security and software damage: An agent may introduce insecure code, change configurations, delete resources or expose secrets through logs and external tools.
• Accountability gaps: Responsibility can be unclear between the model provider, application developer, deploying organisation, tool provider and user.
• Manipulation: Persistent, conversational agents may exert undue influence, particularly when users are vulnerable or the system appears more capable and trustworthy than it is.

What responsible governance looks like

The appropriate controls should match the system’s capability and the consequences of failure.

For predictive AI, organisations should define the purpose, measure accuracy and fairness, protect personal data and provide ways to explain or contest high-impact outcomes.

For generative AI, they should verify important claims, test for hallucinations and harmful outputs, control sensitive data, address provenance and intellectual-property questions, and keep qualified people responsible for legal, medical, financial and safeguarding decisions.

For agents, technical and organisational controls need to go further:

1. Bound the use case. Decide what the agent may and may not do before deployment.
2. Limit access. Use least-privilege credentials, restricted tools, transaction limits and sandboxed environments.
3. Require approval at meaningful checkpoints. Financial, legal, privacy and safety-sensitive actions should not happen without appropriate human authorisation.
4. Make activity auditable. Keep logs, monitor behaviour and assign clear ownership for incidents.
5. Test adversarially. Evaluate prompt injection, data exfiltration, harmful behaviour and failure recovery before and during deployment.
6. Preserve human control. People should be able to stop, override and challenge consequential actions.

Singapore’s Infocomm Media Development Authority sets out this risk-based approach in its Model AI Governance Framework for Agentic AI, which is intended for organisations developing agents internally or deploying third-party solutions. The framework’s central lesson is to graduate autonomy: begin with read-only assistance, move to low-risk actions, and reserve irreversible or high-impact actions for explicit approval.

The direction of travel

The evolution of AI is best understood as an expanding capability stack rather than three completely separate eras. Traditional systems predict and classify. Generative systems create and transform. Agentic systems add planning, tool use and action.

Governance must expand at the same pace. Accuracy and fairness controls remain necessary, but they are no longer enough. Generative systems require strong verification, provenance and content-safety practices. Agents additionally require permission boundaries, action checkpoints, security monitoring and clear accountability.

The more an AI system can do on its own, the more carefully organisations must decide what it is allowed to do.