Regulators must stop treating AI as just another firm-level activity: autonomy and agency shift control into the AI supply chain, so UK and EU frameworks need upstream, active supervision rather than retrospective oversight to control systemic risks.

Main Finding

Current regulatory frameworks break down when regulatees rely on autonomous or agentic AI: responsibility, foreseeability, and control become fragmented across an AI supply chain (developers, deployers, users), undermining governance, supervision, and traditional liability allocation. Regulators must move from retrospective, user‑centric approaches toward active, supply‑chain‑aware regimes that allocate obligations and information flows across multiple actors to manage systemic and runtime risks generated by agentic AI.

Key Points

• Definition and distinction
  • Agentic AI extends LLMs with (1) solution autonomy (decides means to achieve human-set goals), (2) tool‑invocation/recruitment of other agents, and (3) direct external actions (transactions, payments).
  • Goal autonomy (human) vs solution autonomy (AI) is central: unpredictability arises from solution autonomy.
• AI supply chain
  • Typical chain: developer (model/training) → deployer(s) (adaptation/integration) → user (operational use) → recipient (affected party).
  • No single actor has full knowledge or control; knowledge is fragmented and often commercially withheld.
• Core regulatory failures
  • Knowledge & control gap: humans may lack foreseeability of AI failures; meaningful human control becomes difficult or impossible, producing an “accountability gap.”
  • Accountability fragmentation: assigning full responsibility to the user is doctrinally incoherent and mismatched to who created or amplified risks.
  • Governance undermined: standard governance stages (identify risk → safeguards → monitor → improve) are compromised because agentic AI is hard to explain, monitor, and correct; auditing can become performative.
  • Supervision limits: regulators cannot effectively pre‑approve or retrospectively reconstruct causes without better visibility into models and supply‑chain practices.
• Regulatory implication (authors’ orientation)
  • Existing models (user‑focused, retrospective oversight) are insufficient.
  • Regulation should expand scope to include supply‑chain actors and adopt active, adaptive controls to manage runtime and systemic risks.
  • Solutions discussed include allocating duties across developers/deployers/users, enhancing information flows, and shifting from reactive enforcement to continuous oversight (paper explores specifics across four regulatory regimes).

Data & Methods

• Type of study: comparative legal and policy analysis (conceptual/theoretical), supported by literature review and regulatory case examination.
• Regulatory regimes examined: UK regulation of content platforms, data protection regimes, UK financial services regulation (including FCA / Mills Review), and the EU AI Act (cross‑sectoral regime).
• Evidence sources: statutory texts (e.g., AI Act), regulatory reviews (UK FCA), academic literature and preprints (agentic AI, accountability, risk alignment), and illustrative examples/case reports. All cited URLs were last checked 22 July 2026.
• Analytical approach: mapping agentic AI capabilities and failure modes onto existing regulatory assumptions (knowledge, control, accountability), mapping the AI supply chain and identifying where risks/knowledge are produced and obscured, and proposing regulatory design directions informed by comparative regime analysis.
• Limitations: predominantly doctrinal and conceptual (not empirical); the paper synthesizes existing literature and regulatory instruments rather than presenting new quantitative data.

Implications for AI Economics

• Incentives and information asymmetries
  • Fragmented knowledge in the supply chain creates strong information asymmetries: developers may know model failure modes but not disclose them; users may underinvest in monitoring when ignorance reduces liability exposure.
  • Economic agents will respond to regulatory design: placing obligations upstream (developers/deployers) changes investment incentives in safer model design; placing them downstream shifts compliance costs to users.
• Market structure and vertical integration
  • To internalize regulatory obligations and reduce coordination costs, firms may vertically integrate (cloud/provider → deployer → user), concentrating market power among large cloud/AI providers.
  • Smaller deployers/users may be crowded out or face higher compliance costs, affecting competition and innovation.
• Liability, insurance, and externalities
  • Current liability allocation can misprice risk; clear assignment of responsibilities across the chain is necessary to allow insurance markets to function. Unclear liability leads to underinsurance or market withdrawal.
  • Agentic AI generates systemic, correlated risks (runtime drift, sub‑agent recruitment) that standard insurance pools and actuarial methods may not handle without regulatory backstops or mandatory risk mitigation.
• Compliance costs and adoption decisions
  • Active, supply‑chain‑wide regulation (transparency obligations, continuous monitoring, certification) raises compliance costs. Firms will weigh these costs against expected benefits of AI automation, potentially slowing adoption in regulated sectors or increasing prices for AI‑enabled services.
• Innovation vs safety tradeoffs
  • Stricter upstream obligations (e.g., model documentation, mandated test data, runtime monitoring interfaces) can improve safety but may slow iterative innovation and raise barriers to entry.
  • Policymakers need to design incentives (subsidies, liability safe harbors conditioned on verified governance, standards) to balance safety with dynamism.
• Research and modeling needs for AI economics
  • Quantify the compliance and monitoring costs across supply‑chain actors and how these affect pricing and adoption.
  • Model strategic disclosure (or concealment) of model risks among supply‑chain actors and regulators.
  • Analyze insurance market responses to correlated AI risks and evaluate needed regulatory backstops.
  • Study competition effects from potential vertical integration by large cloud/AI providers when regulation increases coordination costs.
  • Incorporate systemic/runtime risk into macroeconomic models of productivity gains from AI adoption (endogenous technology risk).

Summary: The paper reframes regulatory failure not as a narrow legal lacuna but as an economic governance problem: information frictions, misaligned incentives, and systemic risks in the AI supply chain will materially influence firm behavior, market structure, insurance markets, and the social returns to AI. Economic policy responses should therefore combine allocative rules (liability/obligations across the chain), information mandates (transparency, reporting), and incentive instruments to align private incentives with social safety.