Identity collapses
The receiving system sees a privileged machine account, but loses the person whose request started the chain.
Governance questionCan every action still be attributed to an originating person and a named agent?
AI Governance
Your AI governance program is a binder.
Your auditors want a system.
AI governance consulting turns frameworks and policies into operating controls people can follow. Sophizo connects NIST AI RMF, ISO 42001 and the EU AI Act to named owners, evidence and R1 to R4 approval boundaries. The practical question is who checks each consequential action and can explain the decision. See AI classification checklist.
R1 to R4 gives teams a practical operating layer for NIST AI RMF, ISO 42001 and EU AI Act controls. Set the boundary, name the human owner, and keep evidence with the workflow.
NIST AI RMF aligned
ISO/IEC 42001 ready
EU AI Act mapped
The Shape of the NIST AI RMF
4
NIST Functions
Govern · Map · Measure · Manage
19
Categories
Across the AI lifecycle
72
Subcategories
Each with an audit artifact
12
GenAI Risks
NIST AI 600-1 profile
Last reviewed: October 13, 2026
Last reviewed: October 13, 2026. December 2, 2027 is the forcing function for high-risk obligations. Transparency duties under Article 50 already apply. Regulatory dates change. This page is re-verified quarterly.
Frameworks
Three frameworks. One operating system.
They do not overlap perfectly. They overlap meaningfully. Run them as one program.
NIST AI Risk Management Framework 1.0
Published by the US National Institute of Standards and Technology on January 26, 2023.
Full framework context
Published by the US National Institute of Standards and Technology on January 26, 2023. Voluntary, non-prescriptive, and built around 4 functions, 19 categories, and roughly 72 subcategories. The framework tells you what to achieve. It deliberately does not tell you how. That gap is the work, and that gap is also why it has become the de facto standard for US enterprise procurement, federal-adjacent buyers, and any vendor questionnaire that mentions AI.
The four functions: Govern is cross-cutting and applies at all times. Map, Measure, and Manage run iteratively across the AI lifecycle. Findings from Manage feed back into Map as context evolves. Measure is built on TEVV: Test, Evaluate, Verify, Validate. The NIST AI RMF Playbook (March 2023, living document) ships suggested actions per subcategory in CSV, JSON, and Excel for operational teams that need an execution path.
One thing to plan around: AI RMF 1.0 is currently under revision as part of the White House AI Action Plan. The four-function structure is stable and the subcategories are the working unit, so a program built on them will survive the revision. Sector profiles are where the near-term movement is. NIST released a concept note in April 2026 for an AI RMF Profile on Trustworthy AI in Critical Infrastructure, and a Cyber AI Profile is in draft.
Who needs it
Any company selling to US enterprise or federal-adjacent buyers. Any company whose security questionnaire from a customer references AI governance, model lineage, or automated decision-making. Treat the voluntary label as misleading: federal procurement, ISO 42001 audits, and enterprise vendor reviews all anchor to it.
Common gap
Treating Measure as a model performance exercise instead of a risk quantification exercise. The Playbook's suggested actions are the fastest route to closing this gap.
How the four functions relate to each other
Think of it as a continuous operating loop, not a linear sequence. GOVERN is the permanent foundation. It is always on and infused through everything. MAP, MEASURE, and MANAGE cycle continuously throughout the AI system's lifecycle.
G
Govern
Culture, policies, accountability, oversight. The only function that spans the entire organization at all times. Enables the other three to be repeatable.
M
Map
Scope and context. Identify which AI systems exist, who they affect, and what the risk landscape looks like before measuring anything.
Me
Measure
Quantify and track. Use testing, evaluation, verification, and validation (TEVV) to assess identified risks with rigor. Not intuition.
Turn non-determinism into evidence. That's what TEVV is for.
Mg
Manage
Respond. Allocate resources to prioritized risks. Mitigate, transfer, avoid, or accept risk. Build incident response. Monitor continuously.
The implementation gap
The key insight for your advisory practice: The framework is intentionally non-prescriptive. It tells organizations WHAT outcomes to achieve but rarely says HOW in concrete terms. That gap is exactly where a Sophizo engagement sits. We provide the implementation that translates NIST subcategories into board-ready procedures, controls, and KPIs.
ISO/IEC 42001:2023 AI Management System
The international standard for an AI Management System, published December 2023.
Full framework context
The international standard for an AI Management System, published December 2023. Certifiable, audit-tested, and structured around the same Annex SL high-level structure as ISO 27001 and ISO 9001. If your buyers already ask for ISO 27001 certification, ISO 42001 is the version they will ask for next.
The standard requires a documented AI Management System: context, leadership, planning, support, operation, performance evaluation, improvement. Ten clauses, the same shape your security program already uses. The work is not learning a new structure. The work is producing AI-specific evidence inside a structure you already understand.
Two developments since publication change how a certificate should be read. ISO/IEC 42006:2025 sets the requirements a certification body must meet to audit and certify AI management systems, covering competence, impartiality, and audit time calculation. Accreditation bodies assess certifiers against it. And CEN-CENELEC has taken the standard over as EN ISO/IEC 42001:2026, which matters for European buyers.
Who needs it
Any company selling internationally. Any company whose customers already require ISO 27001. Any company in a regulated sector planning to use AI capability as a differentiator in tender responses.
Common gap
Treating it as a paperwork exercise. ISO 42001 audits look for evidence of operation, not the existence of documents. A perfect policy with zero records of execution fails.
Buyer's question
Which certification body, and accredited by whom? A certificate is only as credible as the accreditation behind it. Ask which body issued it, which accreditation body recognized that certifier, whether ISO 42001 sits inside the certifier's accreditation scope, and what the certified scope actually covers. AIMS scope is narrower than the whole company in most cases.
Context and Scope
Operational detail
Define the boundary of your AI Management System: which products, which models, which use cases. Most companies err by scoping too broadly in year one. Tight scope, expand later.
AI Risk Assessment
Operational detail
A documented method for identifying AI-specific risks. Annex B and C of the standard give worked examples. The output is a defensible risk treatment plan auditors can verify.
Operational Controls
Operational detail
Lifecycle controls: data acquisition, training, validation, deployment, monitoring, retirement. Each stage produces evidence. The evidence is what the auditor reviews.
Internal Audit and Management Review
Operational detail
The certification pattern. Internal audit verifies the system works. Management review verifies leadership is operating it. Both produce records the external auditor will examine first.
EU AI Act
Regulation 2024/1689.
Full framework context
Regulation 2024/1689. The first comprehensive AI law in a major jurisdiction. Risk-tiered: prohibited, high-risk, limited-risk with transparency obligations, minimal risk. Enforced through national supervisory authorities with fines up to 35 million euros or 7 percent of global annual turnover, whichever is higher. Phased enforcement: Article 5 prohibitions have applied since February 2025, GPAI model obligations since August 2, 2025, and Article 50 transparency since August 2, 2026. The Digital Omnibus (Regulation (EU) 2026/1744) moved high-risk obligations to December 2, 2027 for Annex III systems and August 2, 2028 for Annex I.
Most US operators discover the Act applies to them through one of two routes. Either they sell into the EU and their AI outputs are used by EU subjects, which makes them deployers under Article 3. Or they are a provider that places an AI system on the EU market. Either route triggers documentation, oversight, and post-market monitoring obligations that take months to stand up.
Who needs it
Any company whose AI outputs are used by people in the EU. Any company placing an AI system or general-purpose AI model on the EU market. Jurisdiction of incorporation does not matter. Output location matters.
Common gap
Assuming the Act is a problem for foundation model providers only. The deployer obligations are where the surprise enforcement risk lives for B2B SaaS.
Article 5: Prohibited Practices
Operational detail
The original prohibited practices cover manipulation, exploitation of vulnerabilities, social scoring, real-time remote biometric identification, untargeted facial recognition scraping, emotion inference at work or school, biometric categorization for sensitive attributes, and predictive policing of individuals. Two new Article 5 bans on non-consensual intimate imagery and CSAM generation apply from December 2, 2026. Check each practice against its applicable ban date.
Annex III: High-Risk Domains
Operational detail
Eight domains where AI systems are high-risk: biometrics, critical infrastructure, education and vocational training, employment and worker management, access to essential services, law enforcement, migration and border control, justice and democratic processes. Employment and worker management catches most RevOps stacks.
Deployer Obligations
Operational detail
Even if you did not build the model, deploying a high-risk AI system in the EU triggers obligations: human oversight, monitoring of operation, logging, instruction-of-use compliance, incident reporting, fundamental rights impact assessment for certain public-interest deployments.
GPAI Model Obligations
Operational detail
General-purpose AI model providers face technical documentation, training data summary, copyright compliance, and safety evaluation obligations. Systemic-risk GPAI carries additional model evaluation, adversarial testing, and incident reporting requirements.
Risk lenses and audit-ready extensions
The 12 GenAI risks tell you what can go wrong. The 7 characteristics tell you what good looks like. Both anchor every Measure and Manage decision.
NIST AI RMF, ISO/IEC 42001, and the EU AI Act are not three competing programs. They are one operating discipline with three compliance extensions. The right sequencing is the difference between framework fatigue and a program that compounds.
Risk Lens
Two lenses. Three extensions.
The 12 GenAI risks tell you what can go wrong, seven characteristics define what good looks like.
Both anchor every Measure and Manage decision.
“Trust is earned by accountable decisions, not policy volume.”
NIST AI 600-1 · Generative AI Profile · July 2024
Top three for B2B operators
Confabulation
Risk control notes
Confidently stated, factually wrong output. The number one risk for business assistants and customer-facing deployments. Requires TEVV baselines, confidence flagging, and human review gates.
Value Chain & Component Integration
Risk control notes
Third-party models, APIs, datasets, and infrastructure introduce risk the deployer does not fully control. The most systemic and underappreciated category. Invisible until failure.
Human-AI Configuration
Risk control notes
Workflow design risk, not a model risk. Automation bias, over-automation, anthropomorphism. No model-level control fixes this. Human-in-the-loop checkpoints and override mechanisms do. Most of your stack should stay deterministic software. A smaller layer is model judgment. A smaller layer still is human approval. The failure mode isn't using AI, it's not knowing which of the three a given decision belongs to.
All 12 categories
CBRN Information
Confabulation
Dangerous, Violent, or Hateful Content
Data Privacy
Environmental Impacts
Harmful Bias & Homogenization
Human-AI Configuration
Information Integrity
Information Security
Intellectual Property
Obscene, Degrading, or Abusive Content
Value Chain & Component Integration
The seven trade off against each other. Managing the trade-offs is the work.
Valid & Reliable
The system performs as intended across deployment contexts. Foundation for all other characteristics.
Safe
Does not pose unreasonable physical, psychological, or societal risk to people.
Secure & Resilient
Resistant to adversarial attacks, data poisoning, model theft, and unplanned operating conditions.
Accountable & Transparent
Organizational processes, AI actors, and system behavior are documented and explainable to stakeholders.
Explainable & Interpretable
Outputs can be explained in terms humans understand. The reasoning process is followable.
Privacy-Enhanced
Data minimization, consent, and individual rights are embedded in design, not bolted on post-deployment.
Fair, Bias Managed
Harmful algorithmic bias is identified, measured, and treated. Outcomes are equitable across demographics.
Four-function sequence
The NIST-first operating sequence.
The right sequencing prevents framework fatigue and lets the program compound.
01
Build NIST AI RMF first
Implementation detail
The four-function structure is the most flexible. It maps cleanly onto both EU AI Act obligations and ISO 42001 requirements without framework-specific constraints. This is your operating discipline.
02
Use ISO 42001 to formalize
Implementation detail
The certifiable wrapper makes the program auditable and durable for enterprise sales and procurement. If you already hold ISO 27001, the shared Annex SL structure makes 42001 a meaningfully smaller lift.
03
Apply EU AI Act categories to triage
Implementation detail
Run every in-scope system through the Act's risk-tier categorization. The output tells you which systems require full high-risk compliance treatment. The Digital Omnibus moved high-risk obligations to December 2, 2027 for Annex III systems and August 2, 2028 for Annex I. The extra runway is real. The triage is not optional, because classification is what tells you which clock you are on.
04
Layer NIST AI 600-1 wherever GenAI is in production
Implementation detail
Twelve GenAI risk categories. 200+ suggested actions. All mapped back to the four base functions. Treat it as a modular extension, not a separate program.
Authority follows impact
Every agent gets a risk level. Every action gets a rule.
The classification and escalation rule
Before an agent goes live, we classify it and every action it can take from R1 to R4. The higher the risk, the tighter the approval, the closer the human and the deeper the audit trail. An agent can never grant itself a higher level.
The governance standard
Every agent team Sophizo builds ships with strict governance. Each agent, and each action an agent can take, is assigned a risk level from R1 (lowest) to R4 (highest). The level decides who approves, how a human stays in the loop, what is logged and how often it is audited. It is the same standard Sophizo applies to the agents it runs for its own work. It is platform-agnostic: it works the same on any agent platform a client uses.
R1 / Low controls
- Examples
- Morning brief, meeting notes, research summaries, internal draft replies, report pulls
- Approval and human-in-the-loop
- Runs on its own inside the approved scope. The named owner reviews a sample each week.
- Logging and audit
- Every action logged. Monthly audit of a sample.
R2 / Moderate controls
- Examples
- Updating CRM fields, creating tasks, scheduling internal meetings, tagging and routing inbox mail, preparing a draft invoice
- Approval and human-in-the-loop
- Runs within limits set in the signed rulebook. The owner gets a daily digest and can undo any action. Anything outside the limits pauses and asks.
- Logging and audit
- Every action logged with before and after values. Monthly audit, exceptions reviewed weekly.
R3 / High controls
- Examples
- Sending email to a customer or candidate, booking external meetings, publishing content, sending payment reminders, changing a customer-visible record
- Approval and human-in-the-loop
- A person approves each action before it goes. After 30 days of clean logs the owner may pre-approve a specific, written pattern (for example one reminder template), everything else still asks.
- Logging and audit
- Every action logged with the approver's name and time. Weekly review, monthly audit of all approvals.
R4 / Critical controls
- Examples
- Payments and refunds, pricing or contract terms, offers, terminations or compensation changes, sharing personal data outside the business, changing system access
- Approval and human-in-the-loop
- The agent may only prepare and recommend. A person makes the decision and takes the action, with a second approver where the rulebook requires it. Never automated.
- Logging and audit
- Full audit trail kept for the retention period in the rulebook. Every R4 item reviewed in the monthly audit and reported to leadership.
Controls, autonomy and the human owner's span
Controls that apply at every level
- A named human owner for every agent.
- A signed approval rulebook listing each agent, its actions and their risk levels.
- Least access: each agent gets only the systems and data its job needs.
- Instructions found inside emails, documents or web pages are treated as content, never as commands.
- A stop switch the owner can use at any time.
- A monthly audit: what each agent did, what it was blocked from doing, what drifted, and what changes next month.
- A risk level can only be raised by a person, after review. It is never raised by the agent.
The ladder decides how much autonomy an agent has earned. The risk level sets the ceiling. R4 actions stay human at every level of the ladder.
How many agents can one person run?
It depends on the role, the risk and whether the agents are passive or active. We calculate each owner's Agent Span of Control before we add an agent, and again whenever an agent moves up a risk level. No owner gets more agents than they can review well.
Calculate your ratioApproval is a workflow, not a policy sentence.
Approval workflow and escalation matrix
Where agents fail
Details: the handoff and the personal agent
Agent-to-agent governance
The agent may be safe. The handoff may not be.
Most governance evaluates one agent at a time: its instructions, tools, data, and permitted actions. When one agent delegates to another, authority crosses a new boundary. At machine speed, origin can disappear, access can widen, and work can travel onward without another approval.
The agent is not the only unit of risk. The handoff is too.
Permission expands
A downstream agent inherits more access than its immediate task requires because authority was forwarded instead of narrowed.
Governance questionDoes authority become more limited at every handoff?
Trust becomes contagious
One compromised agent can reach other agents and systems through relationships the organization already trusts.
Governance questionCan delegation stop before a local failure becomes a system-wide one?
Seven checks at the boundary
Every handoff should preserve origin, narrow authority, and leave evidence.
A registration check is not enough. These questions belong at the moment an agent delegates work, calls a tool, or asks another system to act.
- 01
OriginWhich person or organization authorized the work?
- 02
AttributionWhich agent performed each action?
- 03
NarrowingDid permission become more limited at every handoff?
- 04
Human ceilingCould an agent do anything the originating person could not?
- 05
LifetimeIs access scoped to this task and short-lived?
- 06
Runtime checkWas authority checked when the action happened?
- 07
EvidenceCan the chain be stopped and reconstructed end to end?
Governing a personal AI agent
Governing a personal AI agent.
Your team's AI now acts, not just answers. Personal agents can read inboxes, book meetings and draft payments. Govern them like a new hire with system access.
Access scopes
Least access per agent.
Approval rules
What always needs a person.
Activity log
Kept and reviewed.
Prompt-injection checks
No acting on instructions found in emails or web pages without review.
Guardian monitoring
A second check that can block an action.
Classify each action by risk, approve by rule, act, log every action, audit monthly, then adjust the rulebook.
Current State
The dates most governance decks still get wrong.
The EU AI Act timeline changed in July 2026.
Why older compliance calendars need review
Half the obligations moved. Half did not. Guides written before June are actively misleading.
What changed in July 2026
Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on July 24, 2026 and entered into force on July 27, 2026, six days before the original August 2 high-risk deadline. It deferred the heaviest compliance regime and left the most broadly applicable obligations exactly where they were. If your compliance calendar was built before June 2026, parts of it are wrong in both directions.
In force now
Article 50 transparency.
- Chatbot disclosure
- machine-readable marking of AI-generated content
- and deepfake labeling applied from August 2, 2026 and were not deferred.
Read obligation detail
Chatbot disclosure, machine-readable marking of AI-generated content, and deepfake labeling applied from August 2, 2026 and were not deferred. Enforced by national market surveillance authorities.
In force now
GPAI enforcement powers.
- Obligations on general-purpose AI model providers applied from August 2, 2025.
Read obligation detail
Obligations on general-purpose AI model providers applied from August 2, 2025. From August 2, 2026 the European Commission, through the AI Office, can investigate, demand model access, and impose penalties.
In force now
Prohibited practices.
- Article 5 has applied since February 2025.
Read obligation detail
Article 5 has applied since February 2025.
In force now
Penalty ceiling.
- Article 50 and GPAI breaches sit in the same tier: the greater of 15 million euros or 3 percent of worldwide annual turnover.
Read obligation detail
Article 50 and GPAI breaches sit in the same tier: the greater of 15 million euros or 3 percent of worldwide annual turnover.
Deferred or pending
December 2, 2026.
- Article 50(2) marking obligation reaches generative systems already on the market before August 2, 2026.
Read obligation detail
Article 50(2) marking obligation reaches generative systems already on the market before August 2, 2026. New Article 5 prohibitions also apply, including AI-generated non-consensual intimate imagery and CSAM.
Deferred or pending
August 2, 2027.
- GPAI models placed on the market before August 2, 2025 must be brought into full compliance.
Read obligation detail
GPAI models placed on the market before August 2, 2025 must be brought into full compliance.
Deferred or pending
December 2, 2027.
- High-risk obligations for standalone Annex III systems.
Read obligation detail
High-risk obligations for standalone Annex III systems. Recruitment screening, credit scoring, employee monitoring.
Deferred or pending
August 2, 2028.
- High-risk obligations for AI embedded in regulated products under Annex I.
Read obligation detail
High-risk obligations for AI embedded in regulated products under Annex I.
The delay is real and it is narrow.
Details
Article 50 reaches every customer-facing chatbot you run. That obligation is live today and most teams filed it under 2027.
United States
There is no federal AI law. There are fifty state legislatures.
For a US B2B SaaS company, the binding obligations are state, not federal and not European.
Why state law remains operative
More than 2,000 AI-related bills have been introduced across the states. A December 2025 executive order directed federal agencies to pursue preemption of state AI laws, and a Department of Justice AI Litigation Task Force was stood up in January 2026 to challenge them. The White House followed with a National Policy Framework for Artificial Intelligence on March 20, 2026, a set of non-binding legislative recommendations to Congress. No federal statute or court has preempted any state AI law. Until one does, the state patchwork is the operative rule set, and planning against its disappearance is speculation rather than strategy.
Texas: TRAIGA (HB 149), effective January 1, 2026
Texas: TRAIGA (HB 149), effective January 1, 2026
Intent-based statute. Bans deliberately developing or deploying AI to manipulate, unlawfully discriminate, or infringe rights. The broad high-risk impact assessment regime was cut from the final bill. Enforced by the Texas Attorney General.
Organizations substantially complying with the NIST AI RMF gain safe-harbor protection against enforcement. Documented RMF alignment is now a legal defense in Texas, not just good practice.
Colorado: repealed and replaced
Colorado: repealed and replaced
The 2024 Colorado AI Act (SB 24-205) was repealed and reenacted as SB 26-189, signed May 14, 2026, before it ever took effect. The replacement is a narrower automated decision-making transparency regime centered on consumer notices, adverse-outcome explanations, and human review rights. Substantive obligations start January 1, 2027. Note what did not survive: the original framework safe harbor for NIST AI RMF or ISO 42001 compliance is gone.
California: live since January 1, 2026
California: live since January 1, 2026
SB 53, the Transparency in Frontier Artificial Intelligence Act, targets developers training models above a compute threshold. AB 2013 requires training-data disclosure and applies far more broadly, to any generative AI developer making a system available in California. SB 942, as amended by SB 1000 effective September 30, 2026, adds AI transparency obligations without the 1 million user threshold. CPPA automated decision-making regulations phase in through 2027 and beyond.
Employment is the hot zone
Employment is the hot zone
Illinois HB 3773 amended the Illinois Human Rights Act to cover AI in employment decisions, effective January 1, 2026. New York City Local Law 144 has required bias audits for automated employment decision tools since 2023. If your product touches hiring, promotion, or performance evaluation, you are already in scope somewhere.
The practical answer is not fifty compliance programs.
Details
It is one NIST-anchored operating discipline with jurisdictional overlays, re-checked quarterly.
Free Strategy Brief
The NIST AI Risk Strategy
A board-ready brief on operationalizing NIST AI RMF without hiring a binder writer.
Turn the NIST framework into a 90-day execution plan leadership can approve.
What the brief covers
How to translate four functions, 19 categories, and 12 GenAI risks into a 90-day execution plan your CFO and General Counsel will sign off on. Read it before your next AI risk committee meeting.
What is inside:
- Board-ready framing. How to position AI risk to a board that does not want another binder.
- Function-by-function execution plan. What Govern, Map, Measure, and Manage produce in the first 90 days.
- GenAI Profile triage. Which of the 12 NIST AI 600-1 risks actually matter for your stack, and which are noise.
- Vendor and procurement playbook. The questions enterprise security teams are about to start asking your AI vendors.
No paywall. No sales sequence. Email used only to send the brief.
Send me the brief.
Tell us where to send it. Opens instantly in a new tab.
Operating System
If you can't show them what the agent did, they will never trust it.
Details
An audit trail isn't a compliance checkbox, it's the artifact that earns trust.
Six artifacts. One source of truth.
Build once. Maintain as discipline. Security, ISO, EU supervisory authority, LP, board: all read from the same evidence.
AI Inventory and Risk Register
Evidence detail
Every AI system in production, shadow AI included. Risk tier, owner, review cadence. Refreshed quarterly.
Written AI Policy
Evidence detail
Two pages. What may be used, what data is off-limits, what review is required, who escalates. Two pages is the adoption ceiling.
Vendor Assessment Framework
Evidence detail
One-page checklist every new AI vendor signs. Data, lineage, certifications, termination return. Kills shadow procurement.
Quarterly Board Review Cadence
Evidence detail
Standing fifteen-minute slot. Inventory delta, incidents, top use cases. Builds board literacy without burning the agenda.
Incident Response Runbook
Evidence detail
What happens when an AI system causes harm, leaks data, or fails oversight. Owner, classification, comms, regulator triggers. Tested in a tabletop.
Agent Action Log
Evidence detail
Every autonomous decision, timestamped and traceable: what the agent saw, what it decided, and why. The record your security review, your board, and your own team need before they'll trust the output. This is no longer a nice-to-have. Singapore's IMDA published a Model AI Governance Framework for Agentic AI in January 2026, the first comprehensive governance framework built for autonomous agents, and it requires each agent to carry a verifiable digital identity and an audit trail of which agent acted under whose authorization.
Agentic Layer
The agent standards landed in the last nine months.
No single standard governs autonomous agents yet.
Details
Four converging references now do most of the work, and none of them existed when your governance policy was written.
NIST AI Agent Standards Initiative.
Launched by the Center for AI Standards and Innovation on February 17, 2026. Organized around industry-led standards, open-source protocol development, and security and identity research. The accompanying NCCoE concept paper covers agent authentication, authorization, auditing, non-repudiation, and prompt injection mitigation.
OWASP Top 10 for Agentic Applications 2026.
Published December 10, 2025. The most operationally specific reference available, because it names attack mechanics rather than risk categories: goal hijacking, tool misuse, identity and privilege abuse, memory poisoning, cascading multi-agent failure.
Singapore IMDA Model AI Governance Framework for Agentic AI.
January 2026. Verifiable agent identity and authorization audit trail as baseline requirements.
Berkeley CLTC Agentic AI Risk-Management Standards Profile.
February 2026. The most comprehensive agentic risk taxonomy currently available, structured as an extension of the NIST AI RMF across Govern, Map, Measure, and Manage.
High-risk oversight duties
EU AI Act Article 14 on human oversight and Article 15 on accuracy, robustness, and cybersecurity set requirements for high-risk systems. Providers and deployers have distinct duties, providers carry the heaviest obligations. Annex III high-risk duties apply from December 2, 2027 and Annex I duties from August 2, 2028. Article 50 transparency duties already apply.
By Industry
The framework stack flexes by sector.
Details
HIPAA in healthcare. GLBA and FCRA in financial services. FERPA in education. Bar guidance in legal. C2PA for media. The operating discipline holds across all of them.
Engage
Pick the entry point.
Three shapes. Different commitment. Same operating discipline.
- Controlled environment
- Shadow mode
- Increasing autonomy
- Production
Controlled rollout
Every engagement moves the same way: controlled environment, then shadow mode, then increasing autonomy, then production. Risk goes down at every step, which is why boards approve it.
Governance Diagnostic
2 to 4 weeks
Scored gap assessment across the three frameworks.
Details
Named bottleneck, prioritized roadmap, cost-to-green estimate.
Best for: Teams that need a baseline before they invest.
Scope a diagnosticMost chosen
Governance Build
90 days
The full six-artifact operating system.
Details
Inventory, policy, vendor framework, board cadence, incident runbook, agent action log.
Best for: Teams preparing for enterprise sales, an ISO audit, or a board review.
See the Governance AcceleratorGovernance Operate
Ongoing retainer
Fractional AI governance ownership.
Details
Quarterly board reporting, vendor reviews, incident response, regulator-readiness.
Best for: Teams without the internal capacity to run governance as a discipline.
Talk to usQuestions operators actually ask
Yes, if the output of your AI system is used in the EU. The extraterritorial scope did not change. Article 50 transparency has been enforceable since August 2, 2026 and reaches any chatbot or generative system whose output reaches EU users, regardless of where you incorporate, where you host, or where your sales team sits. The high-risk obligations moved to December 2, 2027 for Annex III systems and August 2, 2028 for Annex I. The Act follows the output, not your jurisdiction.
Both, sequenced. AI RMF 1.0 is the four-function operating model and the durable structure. AI 600-1, published July 2024 under Executive Order 14110, is a cross-sectoral companion profile that extends the framework with 12 generative-AI-specific risk categories and 200+ suggested actions. If you run any large language model in production (copilots, customer chatbots, code generation, document synthesis), lead with 600-1. It maps every risk back to the four base functions, so it is an extension, not a parallel program.
NIST AI RMF is formally voluntary, but the voluntary label is misleading. It is the de facto standard for US enterprise procurement and federal-adjacent work, and enterprise security teams ask for RMF alignment in vendor questionnaires the same way they ask for SOC 2. The strongest argument is now statutory: Texas TRAIGA grants safe-harbor protection against enforcement to organizations substantially complying with the NIST AI RMF, which makes documented RMF alignment a legal defense in that state. The honest counterexample is Colorado. Its original 2024 statute offered a similar affirmative defense for NIST AI RMF or ISO 42001 compliance, and that safe harbor did not survive into the SB 26-189 replacement. The lesson: framework alignment is a strong default, not a universal shield.
No. ISO 42001 certification is issued by accredited certification bodies, not consultants. Sophizo guides readiness, builds the AI management system, runs internal audits, and prepares you for the external certification audit. ISO/IEC 42006:2025 now sets the requirements a certification body must meet to audit AI management systems, so certifier selection matters more than it used to. We help you select an accredited certification body and prepare the evidence, and we stay independent of the body that audits you. We are explicit about this scope to protect the integrity of the certification process.
A defensible baseline takes 90 days. That includes the AI inventory and risk register, a written AI policy, a vendor assessment framework, board reporting cadence, and incident response runbook. ISO 42001 readiness extends the timeline to 6 to 9 months. EU AI Act high-risk system documentation depends on the number of in-scope systems and their classification gates.
A named person, not a committee. In most growth-stage B2B companies that is the General Counsel as accountable owner, with the CIO or VP Engineering as the day-to-day operator, and a quarterly board review. Distributed ownership without a named accountable owner is how governance fails the first incident.
AI ethics is a values discussion. AI governance is an operating discipline. Ethics defines what you should do. Governance defines who is accountable, what gets documented, how systems are monitored, and what happens when something fails. Sophizo works on governance. Ethics is upstream of that conversation and belongs with your leadership team.
It extends them, it does not replace them. Your SOC 2 controls cover access and infrastructure. Your privacy program covers personal data. AI governance covers what those programs do not: model lineage, training data provenance, output explainability, automated decision review, and the operating discipline around AI-specific risks. The three programs share owners, evidence, and tooling wherever possible.
Partly, and the headline is misleading. The Digital Omnibus deferred high-risk obligations to December 2, 2027 for Annex III and August 2, 2028 for Annex I. It did not defer Article 50 transparency, the Article 5 prohibitions, GPAI obligations, or the AI literacy duty. Article 50 is the obligation that touches the most companies, and it has been enforceable since August 2, 2026.
No. An executive order and a set of legislative recommendations are not statutes. No federal law or court decision has preempted any state AI law. State attorneys general have not paused enforcement. Texas, California, and Illinois obligations are live now, and Colorado's replacement statute starts January 1, 2027.
No single standard governs autonomous agents yet, but four references now do most of the work: the NIST AI Agent Standards Initiative, the OWASP Top 10 for Agentic Applications 2026, Singapore's IMDA Model AI Governance Framework for Agentic AI, and the Berkeley CLTC agentic risk-management profile. The practical answer is the same across all four: an agent inventory, scoped credentials rather than standing access, human approval gates on consequential actions, and an action log that records what the agent saw, what it decided, and under whose authorization.
Make governance the operating advantage.
Book a 30-minute scoping call.
About the scoping call
We tell you which framework bites first, what 90 days looks like for your stack, and where security and privacy already do half the work.
Scope and regulatory notice
Guidance, not legal advice. EU AI Act, NIST AI RMF, and ISO/IEC 42001 evolve. Regulatory timelines changed materially in 2026 and continue to move. ISO 42001 certification is issued by accredited certification bodies, not by Sophizo. Engage qualified legal counsel and a certification body for jurisdiction-specific work.
Related reading
- Agentic AI Governance Program and Controls
- AI Regulations for B2B Companies: Practical Guide
- How is B2B SaaS classified under the EU AI Act?
- Who registers AI systems under Article 49?
- How do you map NIST AI actors to harms?
- How do NIST, ISO and EU AI controls overlap?
- What belongs in a RevOps AI risk register?
- How can small businesses use NIST AI RMF?
- Who owns healthcare AI governance liability?
- How do you benchmark AI governance?
- Responsible AI terminology