Governing Agents in an Autonomous Era

Introduction

Executive Summary

Corporate legal has just crossed a threshold that will define the next decade of enterprise risk. AI is no longer a tool that helps lawyers work faster — it’s becoming a system that takes action.

The opportunity agentic AI presents is immense. But without the right guardrails, the risk is also profound. To better understand how these dynamics are playing out on the ground, Icertis commissioned a survey of 1,000 legal corporate professionals. 

The results confirm that the shift to agentic AI has already begun: 1 in 4 legal teams say AI occasionally handles tasks autonomously with humans always in the loop. At the same time, responses suggest this transition has outpaced the systems built to govern it, with visibility, accountability and data policies all lagging behind agentic innovation. Legal is feeling the complexity on two fronts: governing their own use of AI – and agents being adopted across the enterprise.

Organizations that treat contracts not just as legal documents, but as the operating system for how their business runs, will close the governance gap faster. Contracts sit at the center in two ways: 

As a system of action - where AI can accelerate and scale contract tasks, but if misapplied, create real exposure via incorrect terms or overlooked obligations.

As a system of context - providing the data every AI agent needs to operate in line with what the business has actually agreed to.

Today, only 38% of legal teams currently view contracts as an asset for governing AI. Bridging that divide is the single highest-leverage move legal can make in the next 12 months.

Teams that are leading from the front recognize that three capabilities must work together: governance frameworks that set boundaries; human oversight and accountability to keep people in command of high-stakes decisions; and self-auditing AI that monitors its own actions in real time.

Contracts play an integral role as the intelligence layer for automation, providing AI agents with business context to act on operational requirements for the organization. This report unpacks key findings around the confidence gap, the visibility problem, the accountability question, and the data risk – and how contract intelligence closes each one.

Governance Gap

Agentic adoption is outpacing readiness.

AI is advancing at such a tremendous clip: governance policies that work for today’s assistive capabilities aren’t ready for agentic use cases.

As noted, nearly 1 in 4 legal teams say their AI occasionally operates autonomously. For nearly 10%, human review is already the exception. More than 40% say the most sophisticated AI tools used in their organization are already operating at the supervised level, where AI completes actions before a human reviews and approves.

Governance isn’t keeping up. Just 23% of legal teams have a comprehensive, documented agentic AI policy in place. Only 34% say their general AI policy sufficiently covers agentic use cases. But most teams are confident their policies will get there: almost 60% of legal professionals say they will be ready to govern AI agents over the next 12 to 24 months.

More striking, legal teams aren’t confident the AI itself is ready for autonomy. Only 26% are very confident that the AI their team uses is accurate enough to provide reliable intelligence for the high-stakes decisions made across the business, and nearly half (49%) say they must apply human judgment before they can trust what AI produces.

The good news is that AI accuracy can be significantly improved through contextual awareness – awareness that’s provided via data sources like contracts that serve as rich training grounds for purpose-built intelligence.

Visibility Problem

Agents are acting. Legal does not always know.

With agentic AI outpacing the governance to control it, the next question becomes how well legal teams are equipped to detect mistakes when they happen. Would your team know within 24 hours if an AI agent took action without the right people involved? Respondents split almost exactly down the middle:

• 39% said they are very confident they have real-time visibility into their AI agents’ actions.
• 39% said they would likely catch it — but only after the action had already happened.
• 8% said an AI action could go undetected for days or weeks.

The same pattern holds for legal errors in AI outputs. 40% say they review all AI outputs in detail and would catch a substantive legal error quickly. Another 38% are only somewhat confident, expecting to catch errors after the fact rather than in real time.

Self-auditing AI, live monitoring, and reporting capabilities are the foundation for any agentic workflow. And systems like contract intelligence must be designed for instantaneous visibility – so humans can validate AI results in time to act on them.

Accountability Question

When AI gets it wrong, ownership varies.

Governance requires accountability — both a named party responsible when something goes wrong, and someone empowered to prevent it in the first place. The data suggests how varied those choices are.

Asked what would happen if an AI agent took an incorrect action for a team outside of legal, respondents split almost exactly three ways. 23% said the team that deployed the agent – those responsible for selecting, configuring, and releasing it for use would be wholly responsible. 23% said the team that manages it – those overseeing the agent’s day-to-day operation and performance – would be. 22% said it depends on the scenario. Only 10% expect legal to bear accountability when compliance is compromised.

Accountability varies across organizations because of different tools, policy structures, risk tolerances, and operating models. The question isn’t whose accountability model is right. It’s whether the policies set in place by the organization can be enforced.

AI agents are poised for autonomy. But the responsibility for governing them sits within the organization. The data sharpens this point – 35% say legal is the primary owner when it comes to defining policies for how AI can be used and what data it can be used with.

Effective governance starts with effective policies, and contract intelligence helps make them enforceable – turning the rules a company writes into the workflows, and audit trails the accountable team can act on.

Data Risk

The data powering agentic AI is more fragmented — and more exposed — than most acknowledge.

If AI today has spotty governance—as the data here suggests—one reason is the sheer proliferation of AI tools at legal’s disposal. Have a question about a clause? Ask Claude. Want to rewrite a rider? Feed it to ChatGPT.

More than 70% of in-house legal professionals say their team uses generic, large language models in their legal work to some degree. These tools are powerful and widely adopted — but they share foundational limitations. Trained only on publicly available data, they lack the access and understanding of the specific commitments, counterparties, or business context inside any organization. The result is reasoning based on generic probabilities, and a higher propensity for inaccuracy. The 18 percent of legal teams already using purpose-built AI tools are the leading edge – a small but telling group that has matured past generic AI.

Despite limitations, 65% say they use these LLMs on contracts. Fine for one-off tasks, but siloed from the business that legal supports: Only 17% of respondents say their AI tools both send and receive data from other business systems. The majority are working with partial connectivity, sending or receiving but not both. A sizable number, 23%, are fully siloed, with AI data that stays entirely within legal systems.

The consequences are two-fold. At the contract level, AI systems disconnected from the business and the wider contract lifecycle severely limit the context available to the model making decisions—a critical miss in the world of agentic workflows. At the enterprise level, it means other agents don’t have access to the contract language that sets the rules of engagement with suppliers, customers, and partners. It’s like having a self-driving car with no knowledge of traffic laws.

Contract data coupled with connectivity is the fix. Agents grounded in the actual terms, obligations, and agreements driving the business can stop operating on generic probabilities and start operating in reality.

Conclusion

Contracts are the governance layer legal already controls.

Across these pillars, the findings point to a single underlying problem. Organizations have crossed from assistive AI to AI that acts — but governance, visibility, accountability, and the data feeding all three have not made the same crossover.

The question for legal is how to close the gap.

Governance frameworks, human oversight and accountability, self-auditing AI, and contracts as the intelligence layer must work together to define how an organization operates autonomously. Contracts define how an organization runs: they lay the groundwork with customers, suppliers, partners, employees, and regulators.

Today, only 38% of legal teams view contracts as a mechanism for governing AI agents. Another 32% say they do not currently use contracts in this way, but they see the potential. Taken together, roughly 70% of legal teams either already see, or are open to seeing, contracts as governance infrastructure.

The opportunity is clear. The question is whether legal teams will seize it before the risk forces their hand.

Agents execute. Contracts govern. The legal teams that connect the two will define what good looks like for the next decade of enterprise AI.

Explore our 2026 State of Contracting report for a comprehensive view of where AI in contracting stands today—and where it’s headed next.