Sumsub has launched the Sumsub Agentic AI Council, an APAC-focused forum intended to bring policymakers, academics, technology companies, industry groups and civil society together around the practical governance of AI agents. The initiative will focus on agent identity, delegated authority, security, transparency, accountability and oversight as autonomous AI systems move into commercial workflows.
The shift from generative AI that produces content to agentic AI that can plan, decide and take actions is creating a new layer of infrastructure and governance requirements for enterprises.
Sumsub, a digital trust and compliance technology company, is responding with the launch of the Sumsub Agentic AI Council, an Asia-Pacific-focused cross-sector forum designed to develop practical frameworks and recommendations for deploying AI agents.
The company is inviting experts from policy, academia, technology, industry and civil society to participate as founding advisors. The Council will examine issues including agent identity, delegated authority, security, transparency, accountability and human oversight.
The timing reflects how quickly agentic AI is moving into commercial environments.
Agentic AI moves toward real-world transactions
Unlike conventional AI assistants that primarily respond to prompts, agentic systems can execute multi-step workflows and interact with external tools and services.
That distinction becomes particularly important when agents are given authority to perform actions involving money, personal information, business systems or regulated processes.
Commerce is emerging as one of the clearest examples.
Deloitte reports that 74% of Asia-Pacific consumers already use AI to discover, compare and learn about products and prices. Its research also found that 29% of Asia-Pacific consumer businesses were adopting agentic AI in early 2026, with that figure expected to reach 76% within two years.
The technology therefore creates a new question for businesses: how can an organization determine that an AI agent is authorized to act, what it is allowed to do and who remains accountable for the resulting transaction?
Those questions extend beyond conventional identity verification.
Agent identity becomes an infrastructure problem
Traditional digital identity systems are generally designed around humans, organizations and devices. Autonomous software introduces another category: an AI agent acting on behalf of a human or business.
That creates a need to establish an agent’s identity, verify its authority and maintain an auditable record of its actions.
Sumsub says its Council will investigate these requirements through its Adopt, Build and Govern framework.
The Adopt pillar will examine practical agentic AI applications in areas such as compliance, fraud prevention, customer experience and operational efficiency. Build will focus on technical foundations including agent identity, verifiable credentials, secure architectures, traceability and interoperability. Govern will examine policies, standards and accountability mechanisms.
The framework overlaps with concerns already appearing in regional AI governance initiatives.
Singapore’s Infocomm Media Development Authority published its Model AI Governance Framework for Agentic AI in January 2026 and updated it in May with additional case studies and best practices. The framework recommends limiting an agent’s autonomy and access to tools and data, defining points requiring human approval, applying technical controls throughout the agent lifecycle and providing transparency to users.
That provides a useful reference point for organizations building agentic AI systems, but Sumsub’s initiative is aimed at bringing perspectives from multiple sectors into the discussion.
Governance has to follow the agent through its lifecycle
One challenge with agentic AI is that governance cannot necessarily stop at the point of deployment.
An agent may interact with multiple models, APIs, enterprise applications and external services. Its capabilities can also change as underlying models or software components are updated.
This makes traceability and delegated authority important infrastructure capabilities.
An enterprise might, for example, authorize an agent to compare products but not purchase them, or permit an internal agent to prepare a payment but require human approval before funds move. The technical architecture needs to distinguish those permissions and retain evidence of what the agent actually did.
Singapore’s framework similarly emphasizes defined limits on agent powers, human accountability and controls over access to services and data.
Hong Kong is moving in a related direction. Its 2026 Policy Address identifies AI agent management as part of the government’s AI risk-governance strategy and says the government plans to develop AI agent safety-management guidelines for wider society based on experience from government deployments.
Together, these developments indicate that agentic AI governance is becoming a regional infrastructure issue rather than simply an enterprise policy exercise.
Agentic commerce raises the stakes
Commerce is likely to be an important early test of these systems because agents may eventually search, compare and purchase products on behalf of consumers.
Deloitte’s APAC research says almost half of consumers are reluctant to complete transactions without stronger security assurances, despite widespread AI use for product discovery and comparison.
That gap matters.
An agent can be technically capable of completing a transaction while still lacking the trust framework needed to establish whether the action represents the consumer’s intent.
Questions around authentication, spending limits, merchant identity, transaction authorization, dispute handling and audit trails therefore become part of the agentic commerce stack.
For financial services and other regulated sectors, the requirements are even more complex because organizations must also demonstrate compliance and maintain accountability when automated systems take action.
Sumsub’s trust infrastructure approach
Sumsub is positioning the Council alongside technologies it has developed around identity verification, fraud prevention and compliance.
The company points to its Summy AI Copilot, Know Your Agent (KYA) framework and MCP integration capabilities as examples of its work around AI use and governance.
The Council itself is intended to operate as a research and industry forum rather than simply a product initiative. Sumsub says its outputs will include responsible-AI adoption guidance, research and industry reports, stakeholder dialogues and thought leadership.
Its first working group is expected to examine agentic commerce, with a focus on identity, accountability and oversight when AI agents act for consumers and businesses.
That focus connects directly to the emerging distinction between AI capability and AI authority.
A highly capable agent may be able to perform an action, but that does not necessarily mean it should be permitted to perform it. The infrastructure surrounding the agent needs to establish who delegated the authority, what limits apply and how the action can be reviewed afterward.
The next layer of AI infrastructure
For the broader AI industry, the development points to a market expanding beyond models, cloud platforms and application interfaces.
Agent identity, authorization, verifiable credentials, observability, auditability and governance are becoming potential infrastructure layers for autonomous systems.
Deloitte’s research suggests APAC businesses are moving toward broader agent adoption, while regional governments are developing frameworks intended to address the risks created by greater autonomy.
The resulting ecosystem is likely to involve model providers, cloud platforms, identity companies, cybersecurity vendors, enterprise software providers and regulators.
Sumsub’s Council is entering that discussion from the digital trust and compliance side. Its immediate focus on agentic commerce could provide a practical test case for a broader question: how should organizations verify and govern software that increasingly acts as an intermediary between people, businesses and digital services?
As agents gain more authority, proving what an agent is allowed to do may become almost as important as determining what the underlying AI model can do.
Market Landscape
Agentic AI is moving from experimental assistants toward systems capable of coordinating multi-step business and consumer workflows. Deloitte reports that 29% of APAC consumer businesses were already adopting agentic AI in early 2026, with adoption expected to reach 76% within two years.
That expansion is occurring alongside regional governance activity. Singapore’s Model AI Governance Framework for Agentic AI emphasizes bounded autonomy, human accountability, lifecycle controls and transparency, while Hong Kong’s 2026 Policy Address calls for AI-agent safety-management guidelines.
For AI infrastructure providers, the market is consequently broadening into identity, authorization, security, observability, interoperability and compliance. Agentic commerce is one of the clearest areas where these capabilities intersect because autonomous systems may eventually influence or execute purchasing decisions.
Top Insights
- Sumsub’s new APAC council will examine practical governance requirements for AI agents across identity, authority, security, transparency and accountability.
- Deloitte reports that 74% of APAC consumers already use AI to discover, compare and learn about products and prices.
- Singapore’s agentic AI framework emphasizes bounded autonomy, human accountability, lifecycle controls and transparency.
- Hong Kong’s 2026 policy agenda includes developing broader AI-agent safety-management guidelines.
- Agent identity, authorization and auditability are emerging as infrastructure requirements as AI systems gain greater autonomy.
Power Tomorrow’s Intelligence — Build It with TechEdgeAI
