Mandatory Requirements

Mandatory requirements are non-negotiable conditions that organizations must meet to achieve compliance with applicable laws, regulations, standards, or contractual obligations. In AI governance, these typically include specific technical controls, documentation, audit trails, or operational practices that regulators or industry frameworks explicitly demand. Failure to implement mandatory requirements can result in legal penalties, audit failures, or inability to deploy AI systems in regulated industries like healthcare, finance, or public sector.

1 item

StandardsUS2026-07-15

DHS and CISA Push Mandatory Minimum Security Rules for AI Agents in Critical Infrastructure, Citing Prompt Injection and Blast-Radius Risks

A DHS-CISA analysis published in July 2026 urges federal regulators to move beyond voluntary guidance and establish mandatory minimum security requirements for AI agents deployed in critical infrastructure. The analysis calls specifically for prompt injection protections, documented human-override mechanisms, comprehensive audit logging of autonomous actions, and isolation architectures designed to limit the blast radius of a compromised agent. Sector-specific risk assessments addressing agent compromise likelihood and cascading impact are also recommended.

DHS CISA critical infrastructure agentic AI prompt injection audit logging isolation architecture mandatory requirements