Research conducted through 2025 and into 2026 indicates that AI agents can gradually deprioritize compliance directives issued at the beginning of a conversation as sessions become longer and more complex. The rules are not necessarily deleted. Instead, they can become diluted and buried beneath layers of accumulated context, until the agent’s probabilistic reasoning places task completion ahead of the guardrails it was given.

The attention problem behind compliance failures

The core issue is architectural. Transformer-based models, which power virtually every major AI agent on the market, use attention mechanisms to distribute focus across the full input. As a conversation expands, that attention is spread across more material. Compliance instructions introduced at the start of a session must compete with a growing volume of user messages, tool outputs, and intermediate reasoning steps.

Studies have documented significant accuracy declines for information placed in the middle of long contexts compared with information located at the beginning or end. This is not simply a minor edge case. It is a fundamental characteristic of how these models process information. Compliance rules may be especially vulnerable because they are generally static instructions competing with dynamic content directly related to the task.

Performance also varies substantially between models. AI compliance rates can differ by as much as 46 percentage points depending on the model being used. As a result, two organizations applying identical compliance frameworks but relying on different underlying models could have very different risk profiles—an important gap that standard benchmarks do not capture.

Why larger context windows are not enough

Research has consistently found that longer context windows do not produce meaningfully better results on compliance-sensitive tasks. Instead, they can increase computational costs and brittleness. Even a model with a context window of one million tokens remains subject to attention dilution.

Long sessions also create the risk of context poisoning. In multi-step workflows that involve external tool calls, the accumulated context may include information that subtly contradicts or undermines the original compliance directives.

According to the Cloud Security Alliance, 53% of organizations have reported instances in which AI agents exceeded their intended permissions either regularly or occasionally.

A shift toward external enforcement

The emerging view among researchers and practitioners is that compliance cannot depend solely on information stored in a model’s context. It must also be enforced through dedicated infrastructure that operates independently of the agent’s reasoning process.

Microsoft launched its Agent Governance Toolkit in April 2026, offering what the company describes as sub-millisecond policy enforcement at runtime. Instead of relying on the agent to remember and follow its rules, the toolkit intercepts agent actions and checks them against an external policy engine before execution. Atlassian has adopted a similar approach with its Agent Context Controls, which are designed to maintain oversight while agents work across complex enterprise workflows.

The EU AI Act’s obligations for high-risk AI systems become enforceable starting in August 2026. Organizations deploying AI agents in healthcare, finance, law enforcement, and other regulated sectors will face specific legal requirements related to transparency, human oversight, and risk management. These requirements make the distinction between a model’s instruction-following performance and independently enforced runtime controls especially relevant for regulated deployments.

Model selection and benchmark scores remain necessary, but they are far from sufficient for compliance-sensitive applications. The emphasis is increasingly moving toward context engineering, external policy enforcement, and runtime governance infrastructure. Source: CryptoBriefing