From Risk to Response

The previous Linacre Capital papers set out the risks, the liability gap, and the regulatory terrain around AI agents in the enterprise. From Risk to Response answers the question those papers deliberately left open: given everything we now know, what do organisations actually do about it — and how does that answer change now that a new category of enterprise software has crystallised around the problem in the last six months?

The paper will cover

• The ninety-day, six-month, and twelve-month implementation roadmap, mapped to the three-layer governance framework from the earlier risk assessment.
• The five categories of platform that have emerged to address parts of the agent governance problem, and the architectural questions that distinguish them.
• Why purpose-built agent discovery and governance is now a distinct enterprise software category, and what that means for buyers.
• The regulatory mapping in practical terms: where platform capability aligns with HIPAA, the EU AI Act, Colorado SB 205, ONC requirements, and UK regulatory expectations — and where it does not.
• The configuration inheritance problem: how legacy settings customers consented to years ago are now governing agent functionality, without fresh board-level review.
• The limits of what platforms can do on their own, and why consulting and framework work remain essential in regulated environments.
• The role of the board: what can be delegated, what cannot, and where accountability sits when agents are operating inside the business.
• A practical vendor-evaluation framework for organisations making buying decisions in the next six months.
• Sector-specific guidance for healthcare, financial services, and other regulated industries.
• The closing argument: platforms enable governance but do not constitute it, and the board’s job has not changed.