Artificial intelligence agents have entered the corporate market in an irreversible way, negotiating contracts, processing requests, and making decisions that impact consumers in real time without human supervision. The telecommunications sector is just one example of a transformation that spans entire verticals of the economy. However, most companies have not yet answered the most basic question that Governance, Risk, and Compliance demands: who is responsible for the agent?
The ISO 42001:2023 already offers a framework applicable to AI management, similar to what ISO 37.001 represents for anti-bribery. It requires the organization to define the context of AI use, assess impacts, and establish formally documented roles. The starting point is the AI owner, or a designated person responsible for each decision-making system. Without this, the integrity program required by Decree 11.129/22 remains incomplete, as it assumes that risks are mapped and that there are controls over critical processes.
A critical risk is model drift, where an agent trained today may start producing inadequate decisions as the market changes, without anyone noticing. There is also the risk of algorithmic discrimination, when the system offers different conditions based on characteristics that serve as a proxy for protected attributes. However, the most urgent risk may be legal: are contracts celebrated by autonomous agents valid? The Civil Code requires a capable agent, a lawful object, and a prescribed form, as stated in Article 104. An AI agent does not have civil capacity.
Companies should not wait for regulation from ANATEL or other regulatory agencies to have a firm compliance program for the use of AI agents in mass, directly with consumers, as various norms are already in force that obligate the AI owner to conform. Article 20 of the LGPD guarantees the holder the right to request a review of decisions taken exclusively by automated processing. Every company that uses decision-making agents already has an obligation to structure a human review process: who reviews, within what timeframe, based on what criteria.
New regulation will come. Bill PL 2.338/23 already signals obligations for high-risk systems. ANATEL and ANPD will move. However, compliance begins earlier: with an inventory of agents, a policy of AI use approved by top management, and auditability clauses in contracts with suppliers. Companies that wait for the regulator will always consider the management of existing risk irrelevant.
