Transparent Real-Time Governance of Agentic AI Systems

Abstract

Agentic artificial intelligence systems — autonomous, multi-step AI agents capable of planning, tool use, and cascading real-world action — present a qualitatively distinct governance challenge from static AI models. The EU AI Act, while a landmark regulatory achievement, contains a structural gap: it mandates documentation and incident reporting but does not require real-time, publicly verifiable, tamper-proof audit infrastructure adequate for governing agentic systems at the pace and scale of current deployment. This paper documents a pattern of AI-enabled harm across four independent evidential sources — the ENISA 2025 Threat Landscape report, the November 2025 GTG-1002 autonomous cyberattack campaign, the February 2026 breaches of Mexican democratic infrastructure, and concurrent AI-automated attacks at scale — and argues that this pattern establishes the governance case for mandatory real-time accountability infrastructure for critical agentic systems. We propose a three-pillar framework. First, a Public Immutable Audit Ledger (PIAL): a distributed ledger-anchored system recording cryptographically hashed event logs in real time, governed by a technology-neutral requirements framework specifying fourteen functional and non-functional criteria any qualifying platform must satisfy. Second, a revised incident taxonomy separating automated telemetry — immediate, machine-generated — from narrative disclosure obligations, resolving the perverse incentives created by conflating these in existing frameworks. Third, a tiered implementation pathway classifying agentic systems into four risk tiers (Critical, High-Risk, Standard, Experimental) using an operational decision framework, with obligations scaled proportionately. The paper identifies zero-knowledge proof capability as a domain-specific precondition — not merely a research priority — for Tier A PIAL adoption in healthcare and law enforcement contexts where existing legal obligations under GDPR Article 9 and Directive 2016/680 may not be satisfied by current architecture. Six specific legal questions requiring formal resolution by the EU AI Office are identified, spanning GDPR Chapter V data transfers, NIS2 Article 23 interaction, DORA Article 19 alignment, and the data sovereignty status of public distributed ledger anchor submissions. The framework is accompanied by a reference implementation case study and a companion Technical Blueprint. The governance infrastructure proposed is proportionate, deployable with existing technology across the core architecture, and designed to be compatible with the EU AI Act's existing provisions while addressing their identified limitations.