The phrase agentic AI has become a marketing term in 2026 to a degree that makes it harder to evaluate vendors honestly. A meaningful share of products and services sold as agentic AI are RAG pipelines with sales decks. The honest engineering question is what bar must a system meet before the word agentic is accurate, and what bar must a system meet before a regulated enterprise should deploy it.
This is an anti-hype article. It exists because the most common reason regulated buyers waste budget on agentic AI in 2026 is failure to distinguish between systems that have the architectural properties of agency and systems that are marketed as if they do.
Five Properties That Define Agency
An agentic system has five properties: autonomy within explicit constraints, planning that decomposes a goal into ordered subtasks, tool use through callable APIs, persistent state across the workflow, and governed execution with policy enforcement and human escalation. A system missing any one of these is not agentic. It may still be useful, but the failure modes, the compliance surface, and the engineering investment are different.
The five properties are not a checklist where you can have four out of five. Each one is a necessary architectural commitment. A system with autonomy and tool use but no planning is a tool-augmented LLM. A system with planning and tool use but no autonomy is a workflow with LLM steps. A system with autonomy, planning, and tool use but no persistent state is single-shot. A system with all four but no governance is a prototype unsuitable for production.
What RAG Is and Why It Is Not Agentic
Retrieval-Augmented Generation is a technique for grounding LLM outputs in retrieved context. A RAG system receives a query, retrieves relevant documents, and includes them in the prompt that goes to the LLM. The LLM produces a response grounded in the retrieved content. This is a useful pattern with well-understood failure modes and a clear architectural shape.
It is not agentic. The system does not plan a sequence of actions; it executes a fixed retrieve-then-generate pattern. It does not maintain state across a workflow; each query is independent. It does not call tools beyond the retriever; the retriever is the only external capability. The LLM does not decide what to do; it decides what to say. Marketing this pattern as agentic AI is the dominant form of agentwashing.
What a Chatbot Is and Why It Is Not Agentic
A chatbot is a conversational surface. The user types; the system responds; the next turn begins. Some chatbots have memory across turns; some have tool-calling capability. The defining property is that the next action is determined by the user's next message. The chatbot is reactive. An agentic system is proactive within its constraints: given a goal, it pursues the goal until it completes or escalates, without waiting for the user's next turn.
A customer support chatbot that can call APIs to look up account information is not an agent. A customer support chatbot that, given a complaint, autonomously investigates the issue across multiple systems, drafts a remediation, and escalates if confidence is below threshold, is an agent. The difference is who is driving the workflow.
What Tool-Calling Without Planning Is
An LLM can call tools. Most modern frontier models do. The question is whether the tool-calling is planned or reactive. A model that responds to a user request by calling one tool, getting the result, and answering the user is executing a single-step workflow with a tool. This is useful. It is not agentic.
An agent plans a sequence of tool calls, evaluates intermediate results against the goal, and adjusts the remaining plan based on what it has learned. The planning is the differentiator. Tool-calling capability is a prerequisite for agency, not equivalent to it. Systems sold as agentic that turn out to be tool-calling with a single-step plan are common.
Disqualification Signals for Regulated Buyers
A regulated buyer evaluating an agentic AI partner can identify common failure modes through specific questions. What is the kill-switch contract? A vendor unable to describe the specific conditions under which the agent terminates, the state it leaves behind, and the audit record produced is not deployment-ready. What is the policy enforcement point? A vendor that places policy enforcement in the agent (rely on the model to follow the rules) rather than at the tool boundary is delivering a prototype.
What is the audit packet specification? A vendor that produces logs an engineer can read rather than audit packets a regulator can consume has not internalized the regulated buyer's actual requirement. What is the model substitution story? A vendor whose architecture is locked to a single model provider has built a managed services dependency on someone else's API, not an agentic AI system. What is the hallucinated tool call recovery path? A vendor without a designed response to non-deterministic failures is delivering a system that will produce incidents in production.
The Cost of Agentwashing
The cost of accepting agentic in marketing without verifying it in architecture is borne by the regulated buyer twice. The first cost is the deployment that does not deliver: a RAG pipeline marketed as an agent does not have the autonomous workflow capability the buyer purchased. The second cost is the remediation: when the inevitable compliance review surfaces that the deployed system lacks audit trails, kill switches, and policy enforcement, the buyer pays again for the system that should have been delivered the first time.
For organisations subject to the EU AI Act, FDA SaMD requirements, FCA SS1/23, or SR 11-7, the second cost is amplified by regulator interaction. A system whose compliance surface was not architected requires a more invasive remediation than a system whose compliance surface was architected but found insufficient.
The Bar That Matters
The bar for calling a system agentic AI is the five properties above. The bar for deploying an agentic system in a regulated environment is the additional architectural commitments documented in our reference architecture: supervisor pattern, reversibility tiering, designed intervention points, trace-replay tooling, policy-as-code versioning. These are not optional refinements. They are the difference between an agentic system that can be operated and one that cannot.
Regulated buyers in 2026 have a narrow window in which the category is still consolidating and the leaders are not yet fixed. Buyers who accept marketing as architecture will pay for the gap. Buyers who insist on the architectural commitments will get systems that work and that hold up under audit. The choice is at the procurement stage, not at the deployment stage.
EU AI Act: What CTOs Actually Need to Do Before August 2026
The Vendor Rescue Pattern: How to Recover a Failed Implementation in 12 Weeks
The LLM Hallucination Problem in Regulated Environments: What 'Acceptable Error Rate' Actually Means
The engineering behind this article is available as a service.
We have done this work — not advised on it, not reviewed documentation about it. If the problem in this article is your problem, the first call is with a senior engineer who has solved it.