AI System Types: Predictive, Generative and Agentic AI

Why This Topic Matters
The ISACA Advanced in AI Risk (AAIR) certification expects candidates to recognize that not all AI is created equal. The risk profile, governance controls, and audit approach for a credit-scoring model differ dramatically from those for a chatbot that drafts legal documents, and differ again from an autonomous agent that executes transactions without a human in the loop. In the domain of AI Risk Governance and Framework Integration, classifying the AI system type is often the first step in scoping a risk assessment, selecting applicable framework controls (NIST AI RMF, ISO/IEC 42001, EU AI Act risk tiers), and defining accountability. If you misclassify the system, you misjudge the risk, apply the wrong controls, and leave the organization exposed. Exam questions frequently test whether you can identify the system type from a scenario and then reason about the distinctive risks and controls that follow.

What It Is: The Three System Types

1. Predictive AI
Predictive AI (sometimes called discriminative or analytical AI) uses historical data to estimate a future outcome, classify an input, or score a probability. It answers questions like "Will this customer churn?", "Is this transaction fraudulent?", or "What is this person's credit risk?" Typical techniques include regression, decision trees, gradient boosting, and classification neural networks.
Key characteristics:
- Output is a label, score, ranking, or numeric forecast — not new content.
- Behavior is relatively bounded and measurable against ground truth (accuracy, precision, recall, AUC).
- Trained on structured, often proprietary, historical data.
- The dominant risks are bias and fairness (disparate impact from biased training data), model drift (performance decay as real-world conditions change), explainability (especially for high-stakes decisions such as lending, hiring, or healthcare), and data quality/lineage.

2. Generative AI
Generative AI creates new content — text, images, code, audio, video, synthetic data — by learning the statistical patterns of its training data. Large language models (LLMs), diffusion models, and multimodal foundation models fall here.
Key characteristics:
- Output is novel, open-ended, and probabilistic; the same prompt can yield different responses.
- Often built on third-party foundation models, creating supply chain and vendor dependency risk.
- Evaluation is harder: there is frequently no single "correct" answer to measure against.
- The dominant risks are hallucination (confident but false output), prompt injection and jailbreaking, data leakage (sensitive information entering prompts or being memorized from training data), intellectual property and copyright exposure, harmful or toxic content, deepfakes and misinformation, and shadow AI (employees using unsanctioned public tools).

3. Agentic AI
Agentic AI refers to systems that pursue goals with a degree of autonomy: they plan multi-step tasks, make decisions, invoke tools and APIs, interact with other systems or agents, and act in the environment — often with limited or no real-time human intervention. An agent might research a topic, book travel, remediate a security alert, or execute a procurement workflow end to end. Agentic systems are frequently built on top of generative models (an LLM as the "reasoning engine") combined with memory, planning modules, and tool access.
Key characteristics:
- Autonomy and action — the system does things, not just says or predicts things.
- Chains of decisions mean errors can compound and propagate across systems.
- Requires permissions, credentials, and integrations, expanding the attack surface.
- The dominant risks are loss of human oversight and control, unintended or irreversible actions, goal misalignment (optimizing the wrong objective), excessive privilege and access, accountability gaps (who is responsible when an agent acts?), cascading failures in multi-agent systems, and auditability of autonomous decision chains.

How It Works: Mapping System Type to Governance

The practical value of classification is that it drives the governance response. Think of it as a risk escalation ladder:

Predictive AI governance emphasizes model risk management (MRM) practices familiar from financial services: model validation, fairness testing across protected attributes, performance monitoring and drift detection, documented model cards, and explainability mechanisms (e.g., SHAP, LIME) so that adverse decisions can be explained to affected individuals and regulators. Human review is typically applied to high-impact decisions.

Generative AI governance adds a layer of content and usage controls: acceptable use policies, input/output filtering and guardrails, prompt and response logging, red-teaming for jailbreaks and prompt injection, data classification rules on what may be entered into prompts, vendor due diligence on foundation model providers, retrieval-augmented generation (RAG) with grounded sources to reduce hallucination, human review of generated output before it is relied upon, watermarking or disclosure of AI-generated content, and IP/legal review.

Agentic AI governance escalates further to action and autonomy controls: least-privilege access for agents (scoped credentials, time-bound tokens), defined boundaries on permissible actions, human-in-the-loop or human-on-the-loop checkpoints for high-impact or irreversible actions, kill switches and circuit breakers, sandboxing and simulation before production, comprehensive logging of every reasoning step and tool call for forensic auditability, rate limits and spending caps, monitoring for anomalous behavior, and clear ownership so a named accountable human exists for every agent. Governance must also address agent-to-agent interactions and emergent behavior in multi-agent architectures.

Framework Integration
- NIST AI RMF (Govern, Map, Measure, Manage): the Map function explicitly calls for characterizing the system's context and capabilities — system type is central here. The Generative AI Profile (NIST AI 600-1) adds genAI-specific risks.
- ISO/IEC 42001: an AI management system requires an AI system impact assessment; system type shapes the impact analysis and the Annex A controls selected.
- EU AI Act: classifies by use case risk tier (unacceptable, high, limited, minimal) and adds specific obligations for general-purpose AI (GPAI) models — the latter directly targeting generative foundation models.
- ISACA / COBIT lens: system type informs the three lines model — business owners accountable for use, risk/compliance for oversight, internal audit for independent assurance — and informs what evidence auditors should request.

A Useful Mental Model
Ask three questions about any AI system:
1. Does it predict or classify? → Predictive. Focus on bias, drift, explainability.
2. Does it create new content? → Generative. Focus on hallucination, injection, data leakage, IP, vendor dependency.
3. Does it take autonomous actions in the world? → Agentic. Focus on oversight, privilege, irreversibility, accountability, auditability of action chains.
Many real systems are hybrids (an agent that uses a generative model and calls a predictive scoring API). In such cases, the governance must address the highest-autonomy component and the full chain.

Exam Tips: Answering Questions on AI System Types: Predictive, Generative and Agentic AI

Tip 1 – Identify the type from the verbs in the scenario. "Scores," "forecasts," "classifies," "flags" signal predictive. "Drafts," "generates," "summarizes," "creates" signal generative. "Executes," "books," "remediates," "autonomously completes," "invokes tools" signal agentic. Get the type right first; the correct answer usually follows.

Tip 2 – Match the risk to the type. If a question describes an LLM assistant and asks for the MOST significant risk, hallucination, prompt injection, or data leakage is far more likely to be correct than "model drift." If it describes a fraud-scoring model, bias and drift beat "hallucination." If it describes an autonomous agent, loss of human control and unauthorized actions trump content-quality concerns.

Tip 3 – Autonomy increases, so controls escalate. When asked which system type warrants the strictest oversight, kill switches, or human-in-the-loop checkpoints, agentic AI is the expected answer. ISACA emphasizes proportionality: controls should scale with autonomy and impact.

Tip 4 – Remember the "FIRST step" and "BEST" patterns. In governance questions, the first step is typically to inventory and classify AI systems (including by type) and perform an impact/risk assessment — not to buy a tool or write a policy clause. The BEST control is the one that addresses the root risk of that system type, not a generic IT control.

Tip 5 – Watch for hybrid and supply-chain distractors. Agentic systems built on third-party LLMs inherit generative risks plus vendor risks plus autonomy risks. Questions may test whether you recognize that governance must cover the whole chain, including foundation model provider due diligence.

Tip 6 – Accountability always lands on a human. Any answer implying the AI system itself is accountable, or that autonomy removes the need for human ownership, is wrong. ISACA consistently expects a named accountable owner, documented oversight, and auditability.

Tip 7 – Explainability is a predictive-AI hallmark in regulated decisions. Scenarios involving lending, hiring, insurance, or healthcare decisions about individuals point toward explainability, fairness testing, and adverse-action transparency as key controls.

Tip 8 – Distinguish "monitor" from "prevent." For generative AI, guardrails and output filtering are preventive; logging prompts is detective. For agentic AI, least-privilege scoping is preventive; action logging and anomaly detection are detective; kill switches are corrective. Questions about control type depend on this distinction.

Tip 9 – Eliminate answers that are technically true but not type-specific. "Implement access controls" might be true for all systems, but if a more specific answer directly targets the identified type's signature risk, the specific one is correct.

Tip 10 – Think like a risk governor, not a data scientist. The AAIR exam is about governance, risk, and assurance. Prefer answers about classification, impact assessment, accountability, oversight, framework alignment, monitoring, and evidence over answers about algorithm selection or hyperparameter tuning.

Quick Reference Summary
- Predictive: outputs scores/labels; risks = bias, drift, explainability, data quality; controls = validation, fairness testing, monitoring, model documentation.
- Generative: outputs new content; risks = hallucination, prompt injection, data leakage, IP, toxic content, shadow AI, vendor dependency; controls = guardrails, acceptable use policy, red teaming, RAG grounding, human review, disclosure.
- Agentic: takes autonomous actions; risks = loss of oversight, unintended/irreversible actions, excessive privilege, accountability gaps, cascading failures; controls = least privilege, action boundaries, human checkpoints, kill switches, sandboxing, full action logging, named owner.

Master the classification, link each type to its signature risks, and scale controls with autonomy — that is the core competency the exam is measuring in this concept.