Ethical AI needs an audit trail, not a policy document

Most organisations that talk about "ethical AI" mean a values statement: fairness, transparency, accountability, signed off by leadership and filed somewhere nobody reads it again. That was always a fairly weak substitute for engineering. Now it is running out of road entirely.

On 2 August 2026, the EU AI Act's obligations for high-risk systems become enforceable — risk management, human oversight, data governance and transparency, backed by fines of up to €15 million or 3% of global turnover. You do not need an EU office to be in scope. If your system affects people in the EU market, the Act can reach you regardless of where the company is based. Singapore's IMDA has gone further for agentic systems specifically, requiring every agent to carry a verifiable digital identity and an audit trail of which agent acted under whose authorisation. Regulators are converging on the same conclusion from different directions: a principles document does not tell you who did what, and increasingly, that is the question that matters.

Ethics assumed a human was still deciding

The traditional AI ethics conversation — fairness in the training data, transparency in the model card, a human reviewing the output — was built around systems that produced a recommendation and waited. A person read it, applied judgement, and acted or didn't.

Agentic AI removes the waiting. An agent that reads an inbox, triages a queue or approves a transaction is not producing a recommendation for review — it is producing an outcome. If that outcome is wrong, biased or harmful, "we have an AI ethics policy" is not an answer to "which agent did this, on whose authority, based on what input, and why." Without that answer, you cannot investigate the failure, and you cannot demonstrate the regulatory oversight the EU AI Act and equivalent frameworks now expect.

What actually needs to exist

Not a longer policy document. Three specific engineering properties, built into the system rather than described in a PDF:

• Verifiable agent identity. Every action an agent takes should be attributable to a specific agent instance, running a specific version, under a specific human or policy authorisation — not "the automation" in general.
• Decision-level audit trail. Not just infrastructure logs, but what data the agent read, what decision it reached, and why — retrievable after the fact, in a form a non-engineer can review during an incident or an audit.
• A defined human-in-the-loop point. An explicit place in the workflow where a human must confirm before an outcome becomes final, for the categories of decision where that matters — not a dashboard someone is generally expected to watch.

None of this is exotic. It is closer to what a well-run finance or healthcare system already does for any consequential decision. What's changed is that "AI system" no longer buys an exemption from that standard — it is increasingly the reason the standard applies.

Our position

We do not think ethical AI is a values exercise, and we are not going to sell you a workshop to produce one. If you are running or planning an agentic system that makes consequential decisions about people — hiring, credit, access, pricing, support outcomes — the practical question is whether it could survive an audit today: who authorised it, what did it do, and can you prove it. For most organisations we talk to, the honest answer is currently no, and that is fixable with the same infrastructure and logging discipline that makes any production system trustworthy — not a new policy layer bolted on top.