Insights
The thinking behind the work: our white paper, the dates that matter, and what recent research shows about AI agents acting together.
The Three-System Model of Intentional Enterprise Intelligence
White paper, Version 2, October 2026
As AI agents take on work that people used to do, organizations remain answerable for outcomes they can no longer easily see. The paper sets out a model that connects what the organization intends, what its agents do, and the evidence of how authority was exercised. It makes no guarantees, and it says how to test each of its claims.
Inside
- Why agents open an accountability gap, and the five forms it takes
- What recent research on agents working together shows, and its limits
- Where liability and regulation stand in the US and the EU
- The three systems, and the controls that belong to each
- Continuous Inquiry and decision provenance in practice
- A 90-day starting plan
We are sending Version 2 on request while counsel reviews its legal sections.
The calendar for AI governance, 2025 to 2028
The dates most likely to matter to a US organization running AI agents. As of October 2026; a summary, not legal advice.
- California: Civil Rights Council regulations on automated-decision systems in employment take effect.
- Federal: Executive Order 14365 seeks a single national framework for AI and sets up a federal task force to challenge state AI laws. State laws continue to apply unless a court or Congress decides otherwise.
- California: AB 316 (Civil Code §1714.46) bars defendants who developed, modified or used AI from arguing that the AI caused the harm autonomously.
- California: compliance with the California Privacy Protection Agency's rules on automated decision-making technology begins. Colorado: SB 26-189, which replaces the state's 2024 AI Act, takes effect.
- EU: obligations for high-risk AI systems listed in Annex III of the AI Act apply, under the timetable set by Regulation (EU) 2026/1744.
- California: first risk assessments under the Privacy Protection Agency's rules are due; attestations to the Agency follow by April 1, 2028.
- EU: obligations for high-risk AI in products covered by Annex I apply.
Banking
The federal banking agencies' revised model risk guidance of April 2026 excludes agentic AI. The CFPB withdrew its AI-related circulars in May 2025.
Insurance
About half of US states have adopted the NAIC model bulletin on insurers' use of AI.
Broker-dealers
FINRA's 2026 regulatory oversight report covers firms' use of generative AI, including agents.
Sources: AB 316 chaptered text; Mayer Brown on California's employment AI regulations; Willkie on the CPPA regulations; JD Supra on Colorado; Proskauer on Executive Order 14365; Orrick on the model risk guidance; Morgan Lewis CFPB tracker; Quarles on the NAIC bulletin; Debevoise on FINRA's 2026 report. Checked October 2026. Confirm how any of this applies to you with your counsel.
Detection is not containment
In September 2026, a company published a simulation in which societies of AI agents lived and worked together for an extended period while researchers staged attacks on them. It is the most detailed public look yet at how agents behave as a group.
What it found
- No simulated society withstood all three staged attacks.
- Agents that recognized an attack still stored it, shared it or acted on it.
- Models that behaved well on their own did not add up to a society that behaved well. The authors write that model-level alignment is not compositional.
- Agents tended to reinforce one another's errors rather than correct them.
What it does not show
- It was run by a company with a commercial interest in the field, and it has not been peer reviewed.
- It is a simulation. Results may not carry over to the agents and controls in your organization.
What it means for you
Oversight that is assumed to work is not enough. Limits belong outside the model, the power to pause has to be real, and records should come from what agents did.
Source: Akkil et al. (2026), Emergence World: Adversarial Stress-Testing of Long-Horizon Multi-Agent Systems, arXiv preprint, not peer reviewed. Press coverage: Euronews, September 16, 2026.