AI Governance News

RSS feed

Follow daily updates on AI regulation, enforcement, research, and opportunities. Filter the feed by jurisdiction or development type.

Standards×

StandardsUS2026-10-06

GSA AI Acquisitions Clause Takes Effect Before October 19 Deadline

The U.S. General Services Administration has issued an AI acquisitions clause as a regulatory deviation. It applies immediately to new federal contracts. The mandatory effective date is October 19, 2026. The clause adds documentation, testing, and data-use requirements for contractors, and gives the government the right to suspend AI tools at any time. Stakeholders have welcomed data protection improvements while raising concerns about vague language around 'unsolicited ideological content' that could be used as a political pressure point.

federal procurement GSA AI acquisitions government contractors government data protection contract compliance US

StandardsUK2026-10-06

UK Accepts All 44 NHS AI Commission Recommendations, Sets December 2026 Deadline

The UK government has accepted all 44 recommendations from the National Commission into the Regulation of AI in Healthcare. The commitment replaces one-time device approval with a lifecycle-based regulatory model for AI-enabled medical devices. Draft MHRA guidance on AI device change management is due December 2026, with a full implementation roadmap expected by Spring 2027.

MHRA NHS medical AI regulation post-market surveillance lifecycle governance UK regulatory sandbox medtech compliance

StandardsUS2026-10-04

Bipartisan Bills Target AI Agent Liability, Biometrics, and Minor-Facing Chatbots

A cluster of bipartisan bills introduced in Congress in early October 2026 addresses three distinct AI governance gaps. The bills cover criminal and civil liability for AI agent operators in hacking incidents, a federal ban on biometric surveillance tools, and default-safe design rules for chatbots that interact with minors. A fourth bill would fund Department of Homeland Security research competitions focused on AI interpretability and resilience, with $10 million in prizes over five years. None of the bills has yet passed.

AI liability biometric surveillance AI safety legislation federal AI governance agentic AI minor safety US Congress

Get it distilled, every Thursday

We track this daily so you don't have to. One email: what changed, why it matters, what to do next.

From the latest briefing

AI Governance Weekly - October 8, 2026

This Week in One Minute AI systems built to extend your reach are now extending attackers' reach too, and regulators in California and South Korea are making clear that containment failures belong to deployers, not just vendors. A critical

Read this issue →

Free every Thursday. Unsubscribe anytime.

Standards2026-09-29

Trump's Super Intelligence Executive Order: What Compliance Teams Must Know

President Trump signed an executive order on September 29, 2026, framing AI development as a national priority under the banner of 'super intelligence.' The order signals a federal posture strongly oriented toward AI acceleration rather than precautionary regulation. Compliance teams need to understand how this reshapes the federal regulatory environment they are operating in.

executive order US federal AI policy AI acceleration super intelligence regulatory divergence EU AI Act multi-jurisdiction compliance frontier AI

StandardsUK2026-09-23

Anthropic Refuses UK AI Safety Testing, Exposing Voluntary Framework Gap

UK Prime Minister Andy Burnham announced at the UN General Assembly that the UK will establish a National Centre for Information Defence to counter AI-enabled disinformation from hostile states. He also committed to advancing global AI safety standards through the UK's G20 presidency. Separately, Anthropic reportedly declined voluntary model testing with the UK's AI Security Institute, raising questions about the reliability of voluntary compliance frameworks for frontier AI.

Anthropic UK AI Security Institute voluntary testing frontier model testing disinformation AI safety standards G20 international AI governance

StandardsKorea2026-09-18

South Korea Drafts Agentic AI Security Rules as Multi-Jurisdiction Pressure Builds

South Korea's state-run internet security agency has announced it is developing dedicated security guidelines for autonomous AI agents operating with limited human oversight. The guidelines target agentic behavior specifically, not general-purpose AI systems. Enterprises with Korean operations should expect formal requirements around operational controls, review gates, and workflow accountability.

South Korea KISA agentic AI human oversight autonomous AI multi-jurisdiction compliance security guidelines

StandardsGlobal2026-09-17

AI Governance Tooling Market Grows, But Procurement Controls Lag Behind

CSO Online has surveyed 16 commercial platforms designed to help enterprises govern, secure, and audit large language models and AI agents in production. Tools reviewed include Collibra's AI Command Center, Credo AI's policy packs, and F5/CalypsoAI's inference-layer defenses. The survey highlights growing vendor claims around multi-framework compliance alignment, but compliance teams have no established standard for evaluating whether those claims hold up.

Collibra Credo AI CalypsoAI AI governance tooling vendor due diligence compliance procurement LLM governance EU AI Act

StandardsGlobal2026-09-17

CIS MCP Benchmark Sets 55-Point Audit Baseline for Agent Tool Governance

The Center for Internet Security has published an AI MCP Benchmark covering 55 prescriptive recommendations across governance, versioning, transport security, and tool-permission controls. The benchmark applies globally and gives auditors, procurement teams, and regulators a formal standard against which MCP deployments can be measured. Organizations using MCP-enabled AI agents now face a documented gap if their deployments lack policy coverage across those domains.

MCP CIS benchmark agentic AI agent tool security Center for Internet Security transport security agent governance supply chain

StandardsUS2026-09-16

NIST IR 8587 Leaves AI Agent Authorization Without a Federal Standard

NIST, with CISA support, released IR 8587 covering token lifecycle management, audience restrictions, and continuous monitoring for identity and access tokens. The guidance explicitly excludes AI agent authorization scenarios, acknowledging that agentic systems create IAM challenges requiring separate standards still under development. Enterprises deploying AI agents are advised to treat them as low-trust non-human identities and enforce short-lived credentials while formal guidance remains pending.

NIST CISA AI agents identity and access management token security non-human identity agentic AI credential governance

StandardsGlobal2026-09-15

Chrome's WebMCP Guidance Sets a Browser-Vendor Baseline for Agent Tool Security

Google Chrome Developers published official WebMCP tool security guidance recommending that enterprises label untrusted content, mark state-changing tools, restrict tool exposure to trusted origins, and require confirmation gates for non-reversible agent actions. The guidance formalizes tool metadata as a governance artifact and distinguishes read-only from consequential tool access. Enterprise compliance teams deploying browser-integrated AI agents now have a named vendor baseline against which their controls will be evaluated.

Google Chrome WebMCP MCP prompt injection agentic AI tool security agent governance browser security

StandardsUK2026-09-14

UK Parliament Calls for Dedicated AI Bill and Single Oversight Body

The UK Joint Committee on Human Rights published a 100-page report recommending a dedicated AI bill to address human rights risks from artificial intelligence. The report calls for a single statutory AI oversight body, risk-tiered obligations across the AI lifecycle, and outright bans on specific AI uses including subliminal manipulation and inappropriate biometric profiling. No legislation has been introduced yet, but the report marks a significant parliamentary push toward binding AI regulation.

UK AI regulation human rights biometric data AI oversight body prohibited AI uses parliamentary committee multi-jurisdiction compliance

Standards2026-09-12

AI Governance MCP Server Adds Automatable Safety and Risk Controls

AI Governance Institute expanded ai-governance-mcp from three tools to thirteen. Additions cover MCP configuration review, structured risk classification, output validation, and evaluation tracking. Each maps to the Institute’s control library.

MCP servers agentic AI AI governance tooling red teaming risk classification open-source developer tools AI Governance Institute

StandardsUK2026-09-10

NCSC Agentic AI Guidance Sets Sandbox and Logging as Baseline Controls

The UK National Cyber Security Centre published guidance on managing cyber risk in agentic AI systems, identifying sandboxing. Strict access controls, active oversight, and structured logging as essential security requirements. The guidance is directed at enterprise deployers and sets expectations that autonomous AI systems must operate within observable, bounded environments. Organizations running production AI agents are expected to align their deployment architecture with these recommendations.

NCSC agentic AI sandboxing access controls audit logging agent governance UK

StandardsGlobal2026-09-10

CSA Sets MCP Authentication Controls as Baseline Agent Security Requirement

The Cloud Security Alliance published updated guidance establishing that MCP server authentication flows must be treated. Security-critical control points in enterprise agent deployments. The guidance requires authenticated remote server connections using OAuth 2.1 with PKCE. Mandates server metadata validation before any authentication begins. Weak server discovery and uncritical trust in server-provided endpoints are identified as the primary attack vectors enabling metadata manipulation. Unauthorized tool interactions.

MCP OAuth Cloud Security Alliance agentic AI agent security server trust authentication controls

StandardsUS2026-09-08

NIST Draft SP 1353 Puts AI-Assisted CSF Workflows Under Governance Scrutiny

NIST released the initial public draft of Special Publication 1353 on September 3, 2026. Providing guidance on using AI for Cybersecurity Framework analysis and reporting. The draft is open for public comment until October 15, 2026. It directly implicates organizations that use AI tools to conduct CSF control mapping, gap analysis, or security reporting.

NIST Cybersecurity Framework CSF AI-assisted compliance GRC security governance AI output validation

StandardsUK2026-09-02

UK Cyber Bill Puts Agentic AI Risk on Enterprise Deployers, Not Vendors

The UK government has rejected House of Lords amendments that would have placed AI vendors. Frontier model developers within scope of the Cyber Security and Resilience Bill. Ministers are relying instead on voluntary measures, including the AI Security Institute and the AI Cyber Security Code of Practice. As a result, obligations fall on regulated deploying organizations such as managed service providers and datacenter operators. Not on AI model vendors.

UK cyber bill agentic AI vendor liability AI regulation managed service providers deployer obligations AI cybersecurity

StandardsGlobal2026-08-28

Agent Governance Is Becoming Binding: What the August 2026 Landscape Means

LLM Works’ August 2026 summary tracks governance expectations for multi-agent systems across jurisdictions and standards bodies. It reports expanded systemic-risk framing that includes loss-of-control scenarios. Teams can compare orchestration controls and escalation rules with the described standards.

multi-agent agentic AI systemic risk orchestration controls loss of control agent governance standards convergence

StandardsUS2026-08-26

NIST Extends CSF Into AI-Assisted Workflows, Comments Due October 15

NIST released the initial public draft of Special Publication 1353. A quick-start guide for applying AI tools to Cybersecurity Framework 2.0 analysis and reporting. The draft is open for public comment through October 15, 2026. It creates a new expectation that AI used in security analysis workflows should itself be governed, documented, and auditable.

NIST CSF 2.0 cybersecurity draft guidance AI governance documentation security reporting US AI Regulation

StandardsGlobal2026-08-25

Linux Foundation's TRACE Standard Creates a New Audit Baseline for AI Agents

The Linux Foundation has assumed governance of TRACE (Trust, Runtime Attestation and Compliance Evidence). An open specification developed by AMD, Intel, Microsoft, OPAQUE, and TII. TRACE produces cryptographically verifiable records of how AI agents and confidential workloads execute, drawing on existing standards including RATS. EAT, SLSA, SCITT, SPIFFE, and EAR. Enterprise compliance teams should treat it as an emerging baseline for AI agent auditability across cloud, enterprise, and sovereign infrastructure.

Linux Foundation TRACE AI attestation agentic AI runtime compliance audit trail supply chain security confidential computing

StandardsGlobal2026-08-18

OWASP GenAI Sets MCP Server Security Baseline for Enterprise Agents

OWASP GenAI has published a practical guide for secure MCP server development, covering authentication, authorization, session isolation, input validation. Hardened deployment. The guide establishes concrete controls against malicious server behavior, unauthorized tool invocation, and cross-session data contamination. For enterprises running agentic AI workloads, it now functions as a reference standard against which audit readiness will be measured.

MCP OWASP agentic AI authentication session isolation agent tool security supply chain security