September, 2026
Stop Measuring AI Activity. Start Measuring Business Impact
Mike Weis,
CRO, Synergy Group AI, Official Marketing & Lead Generation Partner, AI/MCP Agent™
Every company running AI agents carries risk it didn’t have two years ago. That’s not a reason to stop. Agents are doing real work and paying for themselves. But 2026 changed who pays when an agent gets it wrong, and most leadership teams haven’t caught up.
Here’s what changed, why it’s so hard to fix one agent at a time, and the two real options you have.
Three Things Changed This Year
The Law – California AB 316 took effect on January 1, 2026. It added Section 1714.46 to the state’s Civil Code. If your company developed, modified, or used an AI system that’s alleged to have caused harm, you can’t defend yourself by arguing the AI acted on its own
It isn’t strict liability. A plaintiff still has to prove the case. But “the AI did it” is off the table.
Insurance – Also starting January 1, 2026, new ISO endorsements (CG 40 47, CG 40 48 and CG 35 08) let carriers exclude generative AI losses from standard commercial general liability policies. Some carriers have gone further on D&O and E&O lines.
Your premium may look the same at renewal. Your coverage may not be.
The Losses – In a WitnessAI survey of 300 senior executives at companies with 1,000 or more employees, 43% said AI-related incidents had cost their organization $2 million or more over the past year.
The Risk Doesn’t Go Away
And not every incident involves an attacker. In April 2026, a coding agent at PocketOS, a car-rental software company, deleted the production database and then its backups. It took seconds. The agent wasn’t hacked. It was finishing a routine task.
Put those three together, and you get one uncomfortable sentence. When your agent makes a mistake, you own it, your insurer may not cover it, and what you can prove about that agent is your best defense.
Let’s be honest about this part. No platform, vendor, or policy eliminates AI agent risk. Anyone who tells you otherwise is overselling.
Every agent you deploy can reach something: customer data, a system of record, a budget, a customer conversation. That’s the point of an agent. It’s also the exposure.
So, the goal isn’t zero risk. The goal is risk that’s managed, measured, and provable.
Why One Agent at a Time Doesn’t Work
Most companies didn’t plan their AI footprint. It grew.
Marketing set up an agent. Customer service added another. Someone in finance connected a model to a spreadsheet. Each team picked its own model, its own keys, and its own way of logging. Some didn’t log at all.
At agent one, that’s fine. By agent ten, nobody can answer the basic questions. How many agents are running? What can each one touch? What did they cost last month? What did that one do last Tuesday?
The same WitnessAI survey shows the gap. 70% of respondents are running or piloting agents that take autonomous actions. Only 18% said all of those agents are inventoried and approved by security.
Governance rarely fails at launch. It fails at scale.
Your Two Options
You have two real ways to manage this.
Option 1: Build it yourself
Your team designs, builds, tests, and maintains every control. Cost limits for every model you use. Logging for every agent. An audit trail that holds up. Screening for sensitive data. Documentation that maps to a recognized framework. Then you do it again for the next agent, the next model, and the next rule change.
Large engineering organizations can do this. The question is whether they should, and whether agent fifty will get the same controls as agent one. Somebody also has to prove it all works when an auditor, a broker, or a lawyer asks.
Option 2: Run all agents on a single platform where the controls already exist
That’s what AI/MCP Agent™ is built for.
You also keep ownership of your model and API relationships. You bring your own keys. There’s no markup on usage.
A platform isn’t free of tradeoffs. You adopt its way of working, so evaluate the fit. But the controls are the same on agent one and agent one hundred, and that consistency is the point.
Four Principles That Hold Either Way
Whether you build or buy, these are the principles that matter.
- Consistency reduces risk – The same controls on every agent. No exceptions for the team that set theirs up on a Friday afternoon.
- Visibility drives quality – You can’t fix what you can’t see. Monitoring and review catch problems before a customer or a regulator does.
- Measuring what matters reduces liability and proves ROI – The same data that shows cost per outcome also shows what the agent actually did. One record answers the CFO and the general counsel.
- Records make you defensible – When a broker, an auditor, or a plaintiff’s lawyer asks what happened, you answer with evidence, not a best guess.
What To Do This Quarter
Start with four questions. Get real answers, not estimates.
How many AI agents are running in your company right now, including the ones business units set up on their own?
What is each one allowed to touch?
Could you show what each one did last month?
Does your insurance policy exclude AI? Ask your broker directly.
If any answer is “we’re not sure,” that’s your starting point. Then make the decision: build the controls yourself, or run your agents on a platform where they already exist.
Either way, make it a decision. The companies that drift into this will be the ones building their records under discovery.
If you’d like to see how your agents would look under one set of controls, I’m glad to walk your team through it. Reach me at michael.weis@synergygroup.ai, or learn more at synergygroup.ai/ai-mcp/
This post is for general information and isn’t legal or insurance advice. Talk with your counsel and your broker about your specific situation.
California AB 316 – Section 1714.46 and AB 316 Analysis – Baker Botts
ISO generative AI exclusions: Shumaker, Loop & Kendrick; Fenwick – July 30, 2026
AI security incidents cost large firms millions, study finds – July 24, 2026
Agent-Inflicted Damage: Inside the Real-World Failures of Enterprise AI Systems – Cyera – May 28, 2026