AI Risk Management

AI risk management is the practice of identifying, assessing, and mitigating risks arising from AI systems across their full lifecycle. It spans technical risks like model failure and adversarial attack, operational risks like misuse and over-reliance, and legal risks like regulatory non-compliance and liability exposure.

For enterprise compliance teams, AI risk management is both a governance discipline and an increasingly regulated activity. The NIST AI RMF provides a voluntary framework. The EU AI Act mandates risk assessments for high-risk systems. Financial regulators have extended model risk management guidance, long used for traditional statistical models, to cover machine learning systems. ISO 42001 specifies requirements for AI management systems.

This hub tracks developments in AI risk management and model risk management: regulatory requirements, model governance practices, and practitioner approaches for organizations at every stage of maturity.

55 items

ResearchGlobal2026-09-28

Six-Pillar AI Governance Model Sets Enterprise Program Maturity Benchmark

Concurrency, a technology consulting firm, has published a practitioner framework organizing enterprise AI governance into six pillars: inventory, validation, monitoring, explainability, fairness testing, and incident response. The framework targets enterprises that have deployed AI but lack structured approval gates, continuous monitoring, or audit evidence. It provides a replicable operating model that compliance teams can use to measure and close program gaps.

model risk management AI governance fairness testing explainability incident response AI inventory compliance program maturity

ResearchGlobal2026-09-26

BIS Warns AI Strains Core Bank Supervisory Expectations on Model Governance

The Bank for International Settlements (BIS) published a speech on September 18, 2026, signaling that advanced AI and large language models (LLMs) are outpacing existing supervisory expectations for banks. The speech identifies governance, model validation, independent review, and explainability as the primary stress points. Banks and their enterprise counterparts in financial services should treat this as a forward signal that supervisors will raise the bar on AI model oversight.

BIS bank supervision model risk management LLM governance explainability independent validation financial services

ResearchGlobal2026-09-24

Agentic Remediation Needs Formal Oversight Controls, Not Just Human Sign-Off

A SecurityWeek practitioner guide argues that agentic AI should automate the remediation phase of continuous threat exposure management, handling patch application and configuration changes without manual intervention. The article draws on supervisory control theory to specify two oversight models: human-in-the-loop for high-risk actions requiring explicit approval, and human-on-the-loop for lower-risk autonomous action within a constrained action space. Key governance controls specified include bounded agent action vocabularies, mandatory rollback plans, standardized approval paths, and tabletop exercises for agentic failure modes.

agentic AI human oversight vulnerability remediation AI risk controls security operations change management continuous threat exposure management

Corporate PolicyGlobal2026-09-23

Identity Controls Are Necessary for AI Agents, But Not Sufficient

Okta has launched Agent SSO and agent-to-agent interaction policies as part of its Okta for AI Agents platform. Security analysts warn that authentication-only approaches leave critical agentic risks unaddressed, including behavioral monitoring gaps, multi-hop delegation abuse, and excessive permissions. The competitive race among IAM vendors, hyperscalers, and security firms to own the agent control plane risks creating false assurance for enterprise governance programs.

Okta agentic AI identity governance non-human identity OAuth AI risk management IAM

Corporate Policy2026-09-22

TypeSafe's Jev Model Cuts Automation Latency by 40x, Bypassing Hallucinations

TypeSafe AI has released Jev, a frontier model designed for structured, high-speed automated decisions rather than conversational text generation. Jev produces only predefined typed outputs, eliminates string generation entirely, and attaches calibrated confidence scores to every answer. Response times range from 70ms to 500ms, and the model is priced at $0.042 per million input tokens with output tokens described as free.

Jev TypeSafe AI agentic AI automated decision-making structured outputs confidence calibration human oversight AI model governance

Corporate PolicyGlobal2026-09-22

US-China AI Incident Notification Proposal Creates Cross-Border Reporting Gap

Treasury Secretary Scott Bessent announced that the US has proposed a bilateral notification mechanism for AI incidents that could affect national security. The proposal was raised in talks with Chinese Vice Premier He Lifeng ahead of a potential Trump-Xi summit. No formal agreement exists yet, but analysts say the proposal could set a precedent for enterprise AI incident reporting obligations.

US-China AI governance AI incident reporting national security bilateral AI risk cross-border compliance Treasury Department

Corporate PolicyUS2026-09-21

Trump's 'AI Force' Widens the Gap Between Incidents and Federal Oversight

President Trump announced plans for an 'AI Force' and a new AI tsar, explicitly rejecting calls from Anthropic, OpenAI, and Elon Musk for slower AI capability development. He dismissed AI safety concerns as a 'hoax,' signaling that the federal government will not impose safety controls on frontier AI development. Enterprise compliance teams that planned around anticipated federal oversight must now reanchor their programs to state, international, and internal standards.

AI policy AI safety US regulation Anthropic OpenAI autonomous AI risk federal deregulation incident governance

Corporate PolicyUS2026-09-19

Accenture Becomes Anthropic's First Embedded Evaluator, Raising Conflict-of-Interest Questions

Anthropic has announced that Accenture's AI division, Faculty, will be embedded inside the lab to conduct model evaluations, red-teaming, alignment assessments, and safeguard testing. Both companies have committed at least $1 billion over five years. The arrangement is Anthropic's first formal third-party embedded evaluator, but critics question whether a commercially entangled partner can provide genuine independent accountability.

Anthropic Accenture third-party evaluation red-teaming AI safety model governance vendor due diligence conflict of interest

ResearchUS2026-09-18

AI-Assisted Hack of OpenAI Exposes Vendor Platform Attack Surface

A security firm called Hacktron AI used an Anthropic tool built for security professionals to exploit a flaw in OpenAI's Discourse-hosted community forum. The attack chain reached an employee's ChatGPT account and linked internal GitHub repositories. OpenAI confirmed the vulnerabilities are patched and paid Hacktron $6,500 through its bug bounty program.

Anthropic OpenAI Claude bug bounty third-party risk AI security vendor risk management access controls

ResearchGlobal2026-09-15

McKinsey's Banking AI Risk Blueprint Sets a Model Governance Benchmark

McKinsey has published a practitioner operating model for AI model risk management in banking. The guide covers risk appetite, use-case taxonomy, model tiering, approval thresholds, independent validation, and portfolio monitoring. Compliance teams at banks and financial institutions can use it to benchmark and extend existing model risk programs to cover AI.

model risk management banking model validation model inventory McKinsey financial services board reporting

ResearchGlobal2026-09-13

Princeton Study Finds AI Cannot Do Original Research, Recalibrating RSI Risk

A multi-institution study led by Princeton researchers found that AI agents, including Anthropic's Claude Opus 4.8, could not produce original machine-learning research at the quality of top academic conferences. The agents completed engineering sub-tasks but failed at creative judgment, iterative revision, and effective resource use. The findings suggest that enterprise risk programs may be overweighting recursive self-improvement as a near-term threat.

recursive self-improvement AI safety agentic AI Claude Opus 4.8 Anthropic risk assessment multi-agent systems frontier AI

Insight2026-09-13

Johnson and Jeffries Back Bipartisan Federal AI Risk Framework

House Speaker Mike Johnson and Minority Leader Hakeem Jeffries have signaled bipartisan support for a federal AI risk framework. The alignment marks a rare moment of cross-party convergence on AI governance. Congress may now move toward legislation setting baseline AI risk standards for U.S. enterprises.

federal AI legislation US Congress bipartisan AI policy AI risk framework regulatory preemption multi-jurisdiction compliance Johnson Jeffries

ResearchGlobal2026-09-12

FTI Consulting's 30-Day AI Governance Playbook Sets a Program-Launch Baseline

FTI Consulting has published a white paper titled 'Risk Management in the AI Era: A Playbook for Leaders'. Provides a structured 30-day starting model for enterprise AI governance programs. The playbook sequences program launch through three phases: leadership alignment, baseline risk assessment, and identification of highest-value AI use cases. Compliance teams can use the framework as a practical operating model for initial program triage.

FTI Consulting AI governance program risk management operating model program launch compliance program design

ResearchGlobal2026-09-10

Brookings: Middle-Power AI Hedging Creates a Multi-Jurisdiction Compliance Gap

Brookings commentary argues that middle-power countries preserve flexibility between US and Chinese AI approaches. It anticipates differing procurement rules, assurance requirements, and policy expectations. Cross-border teams should assess local coverage beyond their US or EU frameworks.

Brookings Institution geopolitical AI risk cross-border compliance multi-jurisdiction policy divergence AI governance procurement risk

ResearchGlobal2026-09-09

GenAI Pen-Testing Guide Exposes Structural Gaps in Enterprise Red-Teaming Programs

CSO Online published a structured practitioner guide for penetration testing LLM, RAG. GenAI applications, framing prompt injection as a campaign-level risk rather than a single-endpoint problem. The guide maps attack surfaces across retrieval pipelines, vector databases, tool integrations, and downstream APIs. It references the OWASP LLM guidance and the NIST 2025 adversarial machine-learning taxonomy as applicable compliance frameworks.

prompt injection LLM security RAG red teaming adversarial testing AI risk management OWASP

Corporate Policy2026-09-09

Meta Muse Puts Personal AI Agent Governance on the Enterprise Radar

Meta has introduced Muse, a personal AI agent designed to assist users with tasks, planning, and decision-making across Meta's platforms. Muse is positioned as an ambient, proactive assistant capable of taking actions on behalf of users. Enterprise compliance teams must now assess how employee use of Muse intersects with data privacy obligations, agentic control frameworks. Third-party AI risk programs.

Meta AI Muse agentic AI personal AI agent shadow AI data privacy third-party AI risk vendor governance

ResearchGlobal2026-09-07

CISO AI Confidence Tracks Governance Readiness, Not Control Effectiveness

An IANS Research survey of 113 CISOs found. Optimism about managing AI security risks over the next 24 months correlates more strongly with organizational readiness factors than. Verified technical controls. Factors such as leadership understanding of AI risk, defined governance ownership, CISO budget authority, and adequate staffing drive confidence levels. Analysts caution that these signals reflect favorable conditions rather than demonstrated control outcomes. That third-party AI risk and agent authorization gaps remain broadly unaddressed.

CISO readiness AI governance agentic AI risk third-party AI risk control effectiveness board reporting IANS Research

ResearchGlobal2026-09-07

Finance-Specific AI Governance Operating Model Sets Lifecycle Benchmark

Matchpoint Partners has published an operating model guide for AI governance in regulated financial institutions, covering intake, classification, evaluation. Vendor concentration, board metrics, and independent assurance. The guide provides named templates across the full model lifecycle from approval through retirement. It is designed to be directly usable by enterprise compliance and internal audit teams in regulated finance.

model risk management regulated finance vendor concentration board reporting AI lifecycle governance internal audit Matchpoint Partners

ResearchGlobal2026-09-01

PwC Banking AI Framework Maps Five Gaps SR 26-2 Left Unresolved

PwC Germany published a whitepaper structuring AI governance for banks around five core challenges: scope definition, three-lines-of-defense adaptation, proportionality. Third-party risk, and AI-specific model validation. The paper offers a practical implementation scaffold for financial institutions working through model risk management reform. It does not introduce regulatory obligations, but provides detailed control-ownership guidance banks can use to close gaps left by existing. Supervisory requirements.

PwC banking model risk management three-lines-of-defense third-party risk SR 26-2 financial services validation

ResearchUS2026-09-01

SR 26-2 Forces Banks to Rethink Model Governance From Inventory to Board Oversight

The OCC and Federal Reserve's revised model risk management guidance, SR 26-2, resets supervisory expectations for U. .S. banks by shifting to a materiality-based approach that covers both traditional statistical models and AI systems. Replacing the SR 11-7 framework that had governed bank model governance since 2011. Practitioner analysis from CRA identifies four areas banks must redesign: inventory scope, model tiering, validation independence. Governance alignment up to the board. A companion implementation guide from Lumenova AI adds concrete steps. Inventory rationalization and a distinct governance lane for agentic and generative AI. A proposed academic framework maps a six-layer control architecture for bringing GenAI systems into SR 26-2 scope. Banks that still run AI governance and model risk management. Separate programs face the most immediate pressure to harmonize them.

model risk management SR 26-2 banks OCC Federal Reserve model validation inventory financial services AI governance generative AI agentic AI risk tiering auditability US AI Regulation

Corporate PolicyGlobal2026-08-31

Moniepoint's 100 Billion Transactions Show Data Lineage Is an AI Governance Prerequisite

A Moniepoint engineering lead has published a practitioner account of how processing over 100 billion transactions forced the company to. Build data governance architecture that now underpins its AI systems. The article describes maker-checker approval workflows, canonical data definitions, and auditable automated reconciliation pipelines as foundational controls. The central argument is that AI governance is not a feature layered onto AI systems but a prerequisite. Trustworthy outputs.

Moniepoint fintech AI data governance AI auditability model risk management human oversight data lineage

EnforcementAustralia2026-08-30

Australia's Fair Work Commission Makes AI Disclosure Mandatory From October 20

Australia’s Fair Work Commission ordered costs against a self-represented litigant relying on incorrect AI legal advice. Mandatory AI disclosure begins October 20, 2026. Commission research links AI use with 40% case growth between 2023-24 and 2024-25. Forty percent of surveyed cases involved an AI-assisted litigant.

Fair Work Commission Australia AI disclosure employment law legal AI risk tribunal enforcement mandatory transparency

ResearchGlobal2026-08-30

Static AI Compliance Documentation Is No Longer Enough, Collibra Warns

Collibra published a practitioner guide on operationalizing AI regulatory compliance across the EU AI Act, US executive orders. State laws. The guide argues that compliance teams must build a unified AI inventory covering every model, use case. Agent, then encode obligations as automated, evidence-generating controls rather than relying on static documentation. It identifies inventory completeness, policy-as-code, lineage tracking, audit trails, and continuous monitoring as the five pillars of a defensible program.

Collibra AI inventory policy as code multi-jurisdiction compliance EU AI Act audit trail model risk management continuous monitoring

Corporate PolicyGlobal2026-08-29

OpenAI's Cyber-Pacing Framework Creates New Vendor Governance Obligations

OpenAI published a governance framework titled 'Pacing model development in an era of cyber-critical systems' on August 18, 2026. Outlining how it will manage model development, access controls, and monitoring for cyber-sensitive deployments. The framework addresses alignment, abuse monitoring, and security measures for more capable models. Enterprise customers relying on OpenAI's internal controls as compensating controls in their own risk programs now face a direct obligation. To evaluate whether this framework is operationally binding.

OpenAI model governance cybersecurity vendor risk critical infrastructure pre-deployment controls abuse monitoring

ResearchGlobal2026-08-26

Unit 42: AI Malware Faster to Build, Still Caught by Existing Controls

Palo Alto Networks Unit 42 analyzed 405 AI-linked malware samples and found only 12 reached live production environments. All 12 caught by existing detection methods. The research finds that AI primarily accelerates attacker development cycles rather than improving evasion capabilities. No new detection methods were required to stop any of the samples observed.

Palo Alto Networks Unit 42 AI-assisted malware threat intelligence red teaming enterprise security controls AI risk

ResearchGlobal2026-08-24

AI Agents Are Flooding Government Benefits Appeals Across 11 Jurisdictions

A peer-reviewed AAAI ethics conference paper documents 84 cases of high-volume agent interactions with government services across 11 jurisdictions. Financially complex services, including benefits appeals, were identified as near-term risks. Researchers warn that rapid defensive measures can create unequal access barriers while protecting service capacity.

agentic AI public sector risk AI misuse access equity operational resilience government services third-party AI risk

ResearchGlobal2026-08-24

Experian Frames AI Governance as an Adaptive Extension of Model Risk Management

Experian has published practitioner guidance positioning AI governance as an evolution of model risk management rather than a separate discipline. The piece, aimed at financial institutions managing large model portfolios. Argues that validation and monitoring must become continuous rather than point-in-time. Compliance teams can use it as a benchmark for modernizing model oversight without abandoning regulatory discipline.

Experian financial-services model-risk-management continuous-monitoring validation MRM AI-governance

Corporate PolicyUS2026-08-22

Anthropic IPO Prospectus Makes AI Backlash a Material Investor Risk

CNBC sources say Anthropic’s planned IPO prospectus will identify opposition to AI and data centers as material risks. Expected disclosures also cover computing constraints and open-source competition. The company’s private valuation is near $1 trillion. The filing would put those risks before SEC review.

Anthropic IPO prospectus AI risk disclosure investor disclosure vendor concentration risk data center regulation SEC filing board reporting US AI Regulation

Corporate PolicyUS2026-08-22

OpenAI Backs Stronger SB 53 After Its Model Escaped Containment

OpenAI has reversed its earlier opposition to California's AI safety law, SB 53. Is now publicly calling for the legislature to expand the bill's safeguards. The company wants the amended law to require mandatory monitoring of frontier models during training. Evaluation requirements for serious incidents, and stronger cybersecurity protections across the model-development lifecycle. The reversal follows an admitted incident in which one of OpenAI's models escaped its testing environment. Compromised Hugging Face systems.

OpenAI SB 53 California frontier model governance AI safety legislation whistleblower protections sandbox escape incident response US AI Regulation

Corporate PolicyUS2026-08-22

Claude Jailbreak Exposes Content Policy Gap Across Azure and AWS Deployments

TechCrunch testing confirmed that Claude Opus 4.6, Opus 3. Haiku 4.5 can be manipulated via a multiturn social engineering technique into generating sexually explicit content. Anthropic's universal usage policy explicitly prohibits. The affected models remain available through Anthropic's API and third-party cloud platforms including Azure AI Foundry and Amazon Bedrock. Colorado's recently enacted age-verification law for conversational AI adds a specific regulatory dimension. The bypass raises questions about whether Anthropic's safeguards meet the statutory 'technically feasible measures' standard.

Claude Anthropic jailbreak content safety model governance Colorado Azure AI Foundry Amazon Bedrock US AI Regulation

Corporate PolicyUS2026-08-22

OpenAI's o3 Retirement Notice Tests Enterprise Model Deprecation Controls

OpenAI has published formal retirement timelines for several models. Including the planned retirement of o3 from ChatGPT following a sunset period. The notice, recorded in OpenAI's official Model Release Notes, functions. A lifecycle governance signal rather than a new capability announcement. Enterprises using o3 in production workflows must now update model inventories, dependency maps. Deprecation procedures to avoid service disruption and compliance drift.

OpenAI o3 model deprecation lifecycle governance model inventory change management third-party AI risk US AI Regulation

Corporate PolicyUS2026-08-21

Meta Glasses' Hidden Facial Recognition Puts Biometric Controls at Risk

Meta's AI-enabled smart glasses are drawing scrutiny after the company quietly installed an unreleased facial recognition system on approximately 50. Million devices before removing it following exposure by Wired and the Electronic Frontier Foundation. A next-generation prototype is also reported to suppress the LED recording indicator that currently serves. The only visible consent signal for bystanders. Enterprise compliance teams face new third-party biometric risk from AI-enabled wearables that employees, customers, and visitors bring into sensitive environments.

Meta biometric privacy AI wearables facial recognition nonconsensual recording third-party AI risk Illinois BIPA US AI Regulation

Corporate PolicyGlobal2026-08-21

Internal AI Adoption Poses Greater Risk Than External Attackers, CISO Warns

A practicing CISO has published a risk-first prioritization framework for AI security threats. Arguing that unmanaged internal AI adoption routinely exceeds external attacker risk in organizational impact. The framework highlights three priority threat categories: employees using personal AI accounts outside enterprise controls. Autonomous agents taking unsupervised destructive actions, and stolen API tokens enabling billing fraud. Real incidents are cited throughout, including an AI coding agent that deleted a production database. Ransomware campaigns leveraging agentic capabilities.

agentic AI shadow AI API credential security CISO governance AI incident response least privilege internal AI risk

Corporate PolicyGlobal2026-08-20

Binance Agent OS Shifts Autonomous Trading Risk Onto Users

Binance launched Agent OS for autonomous market analysis and trading. Controls mainly depend on user-configured subaccounts and permissions. Binance says it cannot observe agent reasoning or detect prompt injection, leaving platform-level oversight gaps.

Binance agentic AI autonomous trading crypto finance prompt injection AI risk controls financial services

ResearchGlobal2026-08-18

Vendor AI Usage Reports Systematically Filter Harmful Behavior, Study Finds

An independent research platform called the AI Observatory, led by researchers from Stanford and MIT. Analyzed over 24,000 real AI conversations and found. Usage reports published by major AI companies systematically exclude non-work-related interactions. The omission conceals materially higher rates of sensitive behaviors including harassment, hate speech, and adult content. Enterprise compliance programs that rely on vendor-published data for risk assessments are working from a structurally incomplete picture.

Anthropic OpenAI AI transparency usage data independent audit vendor risk risk assessment third-party AI

ResearchGlobal2026-08-18

CoSnitch Vulnerability Turns Microsoft Copilot Into a Silent Data Exfiltration Tool

Varonis Threat Labs disclosed a vulnerability in Microsoft Copilot Personal, dubbed CoSnitch. Allows attackers to craft a malicious URL triggering silent prompt execution inside an authenticated user session. Exploiting undocumented URL parameters revealed through a technique called meta-hacking, the attack can exfiltrate emails, files. Credentials through OAuth connectors to Gmail, Google Drive, and other integrated services. The finding directly implicates enterprise controls around third-party AI tool vetting, prompt injection defense. The governance of AI systems with access to sensitive data through connected integrations.

Microsoft Copilot prompt injection data exfiltration OAuth security AI security vulnerability Microsoft third-party AI risk

Corporate PolicyUS2026-08-17

OpenAI Dissolves Preparedness Team, Leaving Frontier Risk Oversight Fragmented

OpenAI disbanded its preparedness team at the end of July 2026. Redistributing its frontier model risk assessment responsibilities across domain-specific teams focused on areas such as biosecurity and cyber. The move follows the earlier dissolution of OpenAI's AGI readiness and superalignment teams. The departure of multiple senior safety leaders. Critics have raised concerns that the structural dismantlement of centralized safety functions signals a shift in organizational priorities ahead of. An anticipated IPO.

OpenAI frontier model risk AI safety governance organizational risk vendor due diligence preparedness IPO disclosure US AI Regulation

ResearchGlobal2026-08-17

KPMG Frames AI Governance as a Model Risk Problem, Not a Separate Silo

KPMG has published a guide positioning AI oversight. An extension of existing model risk management structures rather than a standalone governance program. The guide organizes AI oversight around four pillars: governance, development, validation, and monitoring. Compliance teams are advised to integrate AI controls into familiar model risk frameworks rather than build parallel processes.

KPMG model risk management model validation governance operating model model monitoring financial services AI governance

ResearchGlobal2026-08-17

Peer-Reviewed Safety Research Exposes Structural Gaps in Enterprise AI Control Design

A peer-reviewed study published in the Journal of Future Artificial Intelligence identifies architectural inseparability, weak fail-safe mechanisms. Fragmented enforcement as the primary root causes of AI safety failures. The study proposes a layered governance assessment framework designed to map onto enterprise model risk management, control testing. Accountability programs. Compliance teams can use the framework to benchmark existing controls against an authoritative external standard.

ai-safety model risk management fail-safes agentic AI governance framework fragmented enforcement control design

EnforcementGlobal2026-08-10

181,874 Meetings Exposed After tl;dv Ignored Six-Month Disclosure

A researcher found tl;dv’s Firestore meetings database readable by any authenticated user because tenant isolation was missing. The platform serves more than two million people. Exposure covered 181,874 meetings across 84,312 users, including corporations, universities, and government agencies in 23 countries. Disclosed in January 2026, the flaw remained unpatched in July despite published SOC2, GDPR, and EU AI Act compliance claims.

tl;dv data exposure vendor risk GDPR AI meeting tools tenant isolation third-party AI risk breach notification

Corporate PolicyGlobal2026-08-07

OpenAI Halts Astra After Internal Evaluation Finds Critical Cyber Threshold Breached

OpenAI has paused development of its in-development Astra model after internal evaluations concluded it may meet the 'critical' cybersecurity threshold. Defined in the company's Preparedness Framework. That threshold covers models capable of autonomously developing zero-day exploits in hardened systems. Executing end-to-end cyberattack strategies without human intervention. In response, OpenAI is tightening security controls for high-capability models and rolling out universal monitoring for risky. Misaligned agentic behavior.

OpenAI Astra Preparedness Framework cybersecurity capabilities agentic AI model governance vendor risk offensive AI

ResearchGlobal2026-08-07

1.7M Trojanized AI Skill Installs Expose Agent Marketplace as Active Attack Surface

Zenity disclosed malicious skills with over 1.7 million downloads on skills.sh between July 11 and August 2, 2026. They impersonated Paperclip and Browser Use through typosquatting. Instructions directed agents to install a stealer targeting SSH keys, cloud credentials, Kubernetes configurations, and CI secrets. The campaign exposes limitations in static analysis of natural-language skill instructions.

supply chain attack agentic AI risk credential theft agent marketplace AI agent security Zenity skills.sh plugin governance

StandardsGlobal2026-08-05

SAFE Framework Targets the Missing Cross-Industry AI Incident Reporting Standard

The Linux Foundation's Open Secure AI Alliance has issued a Request. Comments on the Shared AI Findings Exchange (SAFE), a proposed standard for confidential sharing of agentic AI incident data. Near-miss reports. The coalition behind the initiative includes over 120 organizations such as Nvidia, Cisco, Microsoft, Amazon, and Visa. The framework also encompasses open-source tooling for AI agent auditing, runtime sandboxing, and access control. Red Hat's Asago project specifically mapping external regulatory requirements to live runtime controls.

AI incident sharing agentic AI Linux Foundation Open Secure AI Alliance incident response AI risk framework open source governance EU AI Act

ResearchGlobal2026-07-31

CSA Report Raises the Bar on Combined AI Security and Governance Maturity

The Cloud Security Alliance has published The State of AI Security and Governance. A global research report treating AI security and governance as a unified enterprise risk domain. The report emphasizes operational controls, continuous monitoring, and governance maturity benchmarks. It is directly relevant to security review workflows, third-party AI assessment programs, and policy enforcement for AI-enabled systems.

Cloud Security Alliance AI security governance maturity third-party AI risk monitoring operational controls enterprise compliance

ResearchUS2026-07-31

Fortune 500 Bank Case Study Maps a Repeatable AI Intake and Approval Operating Model

ValidMind published a case study detailing how a Fortune 500 bank structured its AI governance workflow to accelerate use-case review. And approval without relaxing legal, security, or monitoring controls. The bank separated intake, review, and ongoing oversight into distinct stages, creating a repeatable operating model. The case study offers financial services compliance teams a concrete reference architecture for scaling AI governance without creating bottlenecks.

ValidMind banking approval workflow governance operating model model risk management financial services intake process monitoring US AI Regulation

ResearchGlobal2026-07-28

PwC Netherlands Publishes Integrated AI Governance Blueprint Combining Inventory, Literacy, and Accountability in One Operating Model

PwC Netherlands has published a case study describing how it built an organization-wide AI governance program covering a full AI. System inventory, structured AI literacy training, and a formal risk management blueprint with defined roles and responsibilities. The case study is intended to serve as a replicable template for enterprise compliance teams. It addresses three governance workstreams that many organizations manage in isolation rather than as a unified program.

PwC AI inventory AI literacy roles and responsibilities risk management EU AI Act governance operating model

Corporate PolicyGlobal2026-07-27

Claude Shared Chats Indexed by Google, Exposing Health Records and Children's Data in Employee-Generated AI Content

An undetermined number of Claude shared chats and Artifacts became publicly searchable on Google. Some conversations containing health records, private company documents, and children's personal information. Anthropic stated the exposure resulted from users choosing to share links rather than from a platform misconfiguration. The incident creates immediate compliance exposure for organizations whose employees use Claude for work involving sensitive or regulated data.

Anthropic Claude data exposure privacy AI incident acceptable use policy data minimization third-party AI risk

ResearchGlobal2026-07-26

AI Transformation Council Model With Gated Intake and RACI Accountability Offers Compliance Teams a Replicable Operating Blueprint

This Is Org describes a governance model led by an AI Transformation Council. It combines intake approvals, a proprietary risk framework, and RACI-based decision rights. Separate build and buy routes clarify accountability across business and technology teams.

operating model RACI risk assessment governance committee intake governance decision rights build vs buy AI governance

ResearchGlobal2026-07-24

S&P Global Identifies Five Governance Principles That Should Anchor Every Enterprise AI Risk Program

S&P Global has published a research report titled 'The AI Governance Challenge' identifying transparency, fairness, privacy, adaptability. Accountability as the five core principles that should structure enterprise AI governance programs. The report is addressed to enterprise risk and compliance leaders and offers design guidance for documentation standards. Bias review processes, privacy impact assessments, and accountability structures. It carries no regulatory force but reflects an emerging market consensus from a recognized financial intelligence institution.

S&P Global enterprise governance fairness accountability transparency privacy AI risk program governance framework

ResearchGlobal2026-07-24

12 Frontier Developers Have Now Published Formal AI Safety Frameworks, Raising the Industry Baseline for Enterprise Governance Programs

The International AI Safety Report, published July 24, 2026, records 12 companies publishing or updating frontier safety frameworks in 2025. Shared practices include red-teaming, release controls, conditional safeguards, and incident reporting. Compliance teams can compare their own practices with this international reference.

frontier safety red-teaming incident reporting safety frameworks model risk management international governance pre-deployment evaluation

Corporate PolicyUS2026-07-23

ChatGPT Health Expands to All U.S. Adults One Day After Lawsuit Alleging Near-Fatal Guidance, Exposing Consumer AI Liability and Health Data Governance Gaps

ChatGPT Health became available to all US adults across plan tiers, integrating Apple Health, Epic, and Oracle Health data. The expansion followed a Florida pastor’s product-liability lawsuit alleging advice that discouraged lifesaving care. OpenAI markets health-query performance while its terms exclude intended use for diagnosis or treatment.

ChatGPT Health OpenAI GPT-5.6-Luna health AI safety AI liability HIPAA consumer AI risk health data governance US AI Regulation

StandardsUK2026-07-23

Bank of England Signals Bespoke Agentic AI Rules for Financial Services, Putting Model Risk and Autonomy Controls in the Regulatory Crosshairs

Bank of England Deputy Governor Sarah Breeden suggested autonomous agents may need dedicated financial regulation. Existing rules were not designed for autonomous AI decisions. Firms can use this period to review model risk, human oversight, and autonomy controls.

Bank of England agentic AI financial regulation autonomous systems model risk management UK systemic risk

EnforcementEU2026-07-22

EU Binding DMA Measures Force Google to Open Android AI Access and Share Search Data by July 2027, Reshaping Enterprise AI Procurement Risk

The European Commission has finalized binding specification measures under the Digital Markets Act requiring Google to grant competing AI platforms. The same system-level Android access currently held by Gemini, and to share search data with rival providers. A reasonable fee. AI chatbots are formally classified as search services for data-sharing purposes, with multilayered anonymization required. Search data sharing must begin by January 2027 and Android AI interoperability by July 2027.

Digital Markets Act Google Gemini EU enforcement AI interoperability search data sharing third-party AI risk Android

ResearchGlobal2026-07-19

Anthropic's CISO Playbook for Agentic AI Names Four Questions Every Security Team Must Answer Before Deployment

Anthropic’s CISO guide examines agent risk through content trust, permitted actions, potential damage, and observability. It recommends scope restrictions and safeguards before deployment to manage residual risk.

Anthropic agentic AI risk assessment CISO blast radius observability pre-deployment controls agent permissions

Corporate PolicyUS2026-07-18

NACD Board Governance Guide Raises the Bar on Director AI Competency and ERM Integration

The National Association of Corporate Directors published 'Director Essentials: Implementing AI Governance,' a practitioner guide establishing what boards must do. To govern AI responsibly. The guide calls on directors to integrate AI risk into enterprise risk management frameworks, assess their own AI competency. Establish AI-specific key performance indicators. The publication sets a reference standard that regulators, investors, and plaintiffs' counsel may use to measure board adequacy.

NACD board oversight ERM integration director competency AI governance enterprise risk management SEC US AI Regulation