Built and tested AI agents waiting on compliance approval may reflect real risk

A built and tested AI agent can sit unused inside a regulated company, and that may be a sensible choice. Woodson Martin, CEO of OutSystems, made this case on The Cognitive Revolution. He argued that a good part of the waiting reflects real liability, not just bureaucracy.

What was said

Martin described customers who had designed, built and tested an agentic system, meaning software where an AI model does work on its own. Some of those projects, he said, are "sitting in a compliance backlog", waiting for approval of one specific AI model. He gave no count.

The obstacle he named was training data. Did the model's maker acquire all of it legally? Martin said such worries can slow even simple jobs, like reading PDFs and turning them into structured data. He called model provenance a relatively new question. Defining "enterprise-ready", he also listed older demands: knowing how personal data is handled across six systems, and making sure a model reaches only appropriate data.

The host asked whether this is prudent risk management or a leadership mistake. Martin said it is some of both. Organizations hardening into old habits is real and must be challenged. But regulatory limits are significant, and liability and reputation risks are high. In his words, "a lot of this is prudent decision-making."

Why it matters

Martin spoke of liability and reputation risk for the firm. Our reading is that this risk lands first on compliance teams, who must defend each decision, and then on any customers a bad decision touches.

On that reading, some queues may be rational. Provenance is a record of where a model came from, including its training data. Swap the model and that record changes, so the approval question reopens. Builders and buyers in regulated sectors could treat provenance and audit records as part of the product.

The other side

Martin did not tie the backlog to high-stakes decisions like lending. His own example, reading PDFs into structured data, is plain work, and it was still slowed. That suggests some delay is out of proportion to the risk.

He called part of the caution legacy conservatism and gave no split, so how much of any backlog is prudence stays open. He also leads a platform vendor serving regulated enterprises. He described risk to firms, not customers actually harmed. The step from provenance to audit trails and loan applicants is ours, not his.