GMV discusses security, governance, and validation challenges of AI agents at BIDA Observatory

José Carlos Baquero, Head of the Artificial Intelligence and Big Data Division at GMV’s Secure e-Solutions, took part in the BIDA Observatory panel discussion organized by the Spanish Association of Accounting and Business Administration (AECA) and the Independent Authority for Fiscal Responsibility (AIReF), entitled “Agentic AI: A New Challenge for Data and AI Governance in Organizations.”

The event brought together experts from the technology, institutional, and business sectors to examine the impact of AI agents on organizations, as well as the challenges associated with their deployment, oversight, and governance. 

In his remarks, Baquero addressed one of the most significant yet least visible aspects of this technological evolution: the security and verifiability of agentic AI-based systems. He emphasized that these systems are no longer limited to recommending or predicting information. Instead, they act autonomously, executing tasks and making decisions in complex and dynamic environments.

This new capability introduces specific risks that directly affect the information environments in which AI agents operate, including indirect prompt injection techniques, poisoning of retrieval-augmented generation (RAG) knowledge bases, and jailbreaks embedded in external documents. As he noted, these threats have already been identified and documented by the international research community.

In this context, GMV advocated a transition from traditional assurance models toward continuous Verification and Validation (V&V) processes specifically designed for non-deterministic systems. Unlike conventional software, AI agents can exhibit different behaviors under the same input conditions, requiring new approaches to testing, monitoring, and continuous evaluation.

The discussion, which also featured experts from Mapfre and Engie, highlighted the growing regulatory momentum surrounding artificial intelligence. Particular focus was placed on the European Union’s AI Act and the emergence of new international standards for the testing, evaluation, verification, and validation (TEVV) of AI systems. These frameworks are intended to ensure traceability, continuous risk management, and regulatory compliance in high-impact systems.