We're deploying AI agents and I want to do it in a way that keeps us compliant with NIS2/DORA.

I work in finance and we're currently trying to deploy a few internal AI agents to automate certain tasks (some of which are invoice reconciliation and KYC document processing). Our compliance team is paranoid about the upcoming DORA and NIS2 requirements and theyd like for everything to be in order for when the time comes to be audited. AI behavior can be sometimes unpredictable and we want to safeguard/guardrail our agents so that in the event a breach happens, we know who to hold accountable and how. We want to avoid quandaries like "if an AI agent leaks some data, should we blame the employee using the agent or the API provider?" We use Wazuh for threat detection and Passwork for secrets management so we can just export the logs straight to the auditors, but tracking the actual decision-making and data access paths of an AI agent is where it gets iffy. It feels impossible to strike a balance between getting full transparency on what the agent is touching and not hindering its autonomy too much. How can we deploy them, if at all, while still honoring the regulations? TIA!!