European Union technology chief Henna Virkkunen says the bloc’s AI Act is equipped to address risks from increasingly capable AI systems. Speaking on 9 October, she defended oversight throughout a model’s life cycle. The European Commission is also assessing responses to information requests sent to more than 30 AI companies.
The debate is especially relevant as AI products move beyond generating answers and begin carrying out tasks. An assistant that drafts a message creates a different operational risk from one allowed to send it, change a database or approve an action without another person checking.
From answers to actions
For businesses, the first useful distinction is between what a system can suggest and what it can execute. Giving an agent access to tools turns a software response into a potential change in the real world. That makes permissions part of product design, alongside accuracy and speed.
A system should have access only to the information and actions required for its assigned task. Human review can then be placed where an error would be expensive or difficult to reverse. The design should also make it possible to stop the system and understand what happened.
Testing before deployment remains useful, but a single successful demonstration cannot establish continuing reliability. Models, connected services and business processes can change. Oversight needs to account for the behaviour of the complete workflow, including the people expected to supervise it.
Records are valuable here. If a company cannot identify which action was proposed, who authorised it and which system executed it, investigating a failure becomes much harder. A clear responsibility chain also helps staff recognise when an agent has moved outside its intended role.
Implications for local firms
Bangladeshi technology companies serving overseas customers may encounter AI governance requirements through contracts, procurement reviews and requests for documentation. Preparing an explanation of data access, monitoring and human control can therefore support business relationships as well as internal operations.
Domestic firms have similar practical reasons to define boundaries. A limited agent answering routine enquiries is easier to evaluate than a broadly empowered system working across several departments. Starting with a narrow task can make mistakes more visible and improvements easier to measure.
The EU’s position is part of an ongoing regulatory discussion, rather than a guarantee that every future risk has been solved. For companies adopting AI agents, the immediate lesson is straightforward: decide what the software may do, retain accountable supervision and check whether those controls continue to work after launch.
