On 18 May 2026 the NCSC reissued joint guidance with CISA, the NSA and its Australian, Canadian and New Zealand counterparts on the 'Careful Adoption of Agentic AI Services.' Agentic AI - AI that does not just answer questions but plans, decides and takes actions inside your IT environment - is now arriving inside the SaaS that UK schools, charities and SMBs already pay for. We unpack what changes about the risk picture, why the procurement signal is invisible, and what to do across the next 30, 60 and 90 days before switching it on across the organisation.
Key takeaways
- On 18 May 2026 the NCSC reissued the Five Eyes' 'Careful Adoption of Agentic AI Services' guidance, paired with a UK-specific NCSC blog. Agentic AI is now mainstream enough that the safe-use guidance applies to organisations that buy SaaS, not only to those that build models.
- Agentic AI is different from conversational AI in one decisive way: agents take actions on your behalf, often under the user's credentials, with standing access to data and tools. Every familiar LLM risk - prompt injection, data leakage, hallucination - still applies, but the worst-case outcome is now an action rather than a draft.
- For UK schools, charities and SMBs, agentic capabilities are arriving inside Microsoft 365, Google Workspace, the LMS, the finance system and the helpdesk - not as new procurement. Make a one-page inventory in the next 30 days of where agents are switched on, what they can read, what they can do, and the named human who reviews their actions.
- Tighten access and credentials in the next 60 days: least privilege for every agent, scoped or short-lived API keys instead of long-lived service accounts, and phishing-resistant authentication for any admin who can switch agents on or off. The NCSC's default-to-passkeys recommendation now applies twice over to those roles.
- Write a one-page agentic-AI acceptable-use note and run a 30-minute tabletop with senior leadership on a single 'the agent did something we did not intend' scenario in the next 90 days. The Cyber Resilience Pledge's board-level cyber-ownership action is the standing scaffolding for this work.
On 18 May 2026, the NCSC reissued joint guidance with its Five Eyes counterparts — CISA and the NSA in the United States, the Australian Cyber Security Centre, the Canadian Centre for Cyber Security, and New Zealand's NCSC — on the "Careful Adoption of Agentic AI Services." The thirty-page document, first published on 1 May, has now been formally picked up by the UK NCSC and paired with a UK-specific blog titled "Thinking carefully before adopting agentic AI." The renewed call is the loudest official signal so far that agentic AI is no longer a research-lab curiosity and that the safe-use guidance now applies to organisations that buy software, not just to organisations that build it.
For ReadyToday's audience — UK schools, multi-academy trusts, colleges, charities and SMBs — that matters now because agentic AI is no longer something you have to deliberately go and procure. It is arriving inside the productivity, finance, HR, helpdesk and learning platforms you already pay for. Microsoft Copilot is being upgraded with "agent" workflows. Google Workspace has Gemini agents inside Gmail, Drive and Calendar. Canvas, Bromcom, ParentPay, Iris and Sage are all in some stage of shipping AI assistants that can do work without being asked twice. The decision in front of small UK organisations this quarter is no longer "should we use AI?" — it is "should we let these tools take actions on our behalf, and if so, with what guardrails?"
What "agentic" actually means, and why the guardrails change
The shorthand is useful. Generative AI generates: it writes a draft, summarises a document, classifies a record, suggests a reply. An agentic system goes a step further. It plans a sequence of steps, chooses tools to use, calls into other systems, and acts — sending the reply, updating the record, raising the purchase order, refunding the customer, booking the room. The NCSC's blog puts it succinctly: agents do not just generate content or predictions, they decide and act on your behalf.
That single shift changes what cybersecurity needs to look at. With a conversational assistant, the worst-case outcome of a prompt injection or a hallucination is usually a bad draft that a human discards before it goes anywhere. With an agent, the same prompt injection can result in an email sent, a calendar invite accepted, a Drive file shared with an outside address, or a refund issued — all under the user's credentials, all logged as that user's activity, all without the user having seen any of it.
The NCSC and its partners frame the resulting risk picture as a combination of three things. First, every familiar Large Language Model failure mode (jailbreaking, prompt injection, hallucination, data leakage through prompts) still applies. Second, agentic systems take broader access — to data, to tools, to external APIs — than the assistants that came before them, and tend to keep that access standing for longer. Third, the autonomy and complexity make behaviour harder to predict and test; the same agent can take different paths to the same goal on different runs, which makes change control and audit harder than for the deterministic software they sit alongside.