AI Governance Frameworks for AI Agents: Which Ones Apply

An AI governance framework for AI agents is a published set of requirements, guidance or law that tells an organisation what it must control when software acts on its behalf, and what it must be able to show afterwards. The instruments that dominate the enterprise conversation in 2026 are not alternatives to one another. They are different kinds of document, they attach to different things, and a single team can be inside more than one at the same time.

Which makes "which framework should we adopt" the wrong opening question. Adoption is not what decides whether a framework applies to you. Jurisdiction, contract and customer procurement are.

Why does the question get harder when the system is an agent?

A model returns an answer. An agent takes an action — it calls a tool, moves money, writes to a ticket, sends the email, deletes the row. The governance question moves with it, from was the output acceptable to was that action authorised, and can you show who authorised it.

Prompt injection makes the difference concrete. OWASP ranks it LLM01 in its 2025 list for LLM and generative AI applications — first position, ahead of sensitive information disclosure and supply chain. Against a chatbot, a successful injection produces a bad sentence. Against an agent holding a live tool credential, it produces a real call to a real system under your agent's identity, and the only thing between the instruction and the action is whatever was evaluating at that moment.

The same shift lands on record-keeping, where the numbers are unforgiving. Article 26(6) of the EU AI Act requires deployers of high-risk AI systems to keep the logs those systems automatically generate — to the extent the logs are under their control — for a period appropriate to the intended purpose, and of at least six months unless other Union or national law provides otherwise. That is not a reporting exercise you assemble the week before an audit. It is a property of how the system runs: an agent that produced no durable record of a decision in March cannot produce one in September.

The analogy: building codes, trade standards and the certificate of occupancy

Construction has had this layered structure for a century, and it maps almost cleanly.

The building code is law. It applies because of where the building is, not because the developer opted in. The quality-management standard the construction firm holds is voluntary, and it addresses the firm's processes rather than any one building. The professional practice manual is guidance the engineer follows by training and judgement. The defect checklist the inspector carries is a running list of known failure modes, updated as new ones turn up in the field.

And the certificate of occupancy is issued after someone inspects the building as constructed. Not the blueprint, not the firm's process documentation — the building. That inspection record is the part agent programmes tend to under-build, and it is what Article 12 record-keeping and the AI RMF's Measure function are both ultimately asking to see.

Which AI governance framework applies to your agents?

The third column is what decides your obligations. The EU AI Act is a Regulation — directly applicable law that reaches you through where a system is placed on the market, not through anything you chose. The others take effect through adoption: a contract, a certification decision, a regulator's expectation, or an engineering standard a team holds itself to. NIST describes its framework as "intended for voluntary use." ISO's own summary describes ISO/IEC 42001 as specifying requirements for an AI management system, while 42005 and 23894 are published as guidance, as their titles say. The OWASP lists are open community work; OWASP says the 2026 agentic edition was developed with more than 100 industry experts, researchers and practitioners.

Standards bodies are now moving on agents specifically. NIST's Center for AI Standards and Innovation launched an AI Agent Standards Initiative on 17 February 2026, organised around three pillars: industry-led agent standards, community-led open protocol development, and research into agent security and identity. That initiative and the OWASP agentic list are where the agent-specific detail is arriving fastest. Our breakdown of the OWASP agentic risk categories covers that list, and what a governance framework contains in the abstract is covered in AI agent governance framework.

What changed on the EU AI Act deadline, and what did not

Worth stating with both ends of the change visible, because planning documents written earlier in 2026 carry the old date.

The AI Act originally set 2 August 2026 as the general application date for Chapter III, Sections 1 to 3 — the requirements on high-risk AI systems and the obligations of their providers and deployers — with AI embedded in products under Annex I following from 2 August 2027 under Article 113(c) as adopted. That is the chapter containing Articles 9, 12, 14, 15 and 26.

Regulation (EU) 2026/1744, the Digital Omnibus on AI, replaced that date. Its enacting text sets application of Chapter III, Sections 1, 2 and 3 at 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III, and 2 August 2028 for AI embedded in products covered by Annex I. The Omnibus was signed on 8 July 2026, published in the Official Journal on 24 July 2026, and is in force.

Two things follow. The article numbers did not move — a control mapped to Article 12 is still mapped to Article 12. And the deferral is enacted law rather than a proposal, which turns the planning question from whether it will happen into what you build in the time it bought.

What each framework actually asks you to produce

Strip away the vocabulary differences and the same artifacts keep reappearing. Each one either exists in your system or does not.

1. A versioned policy, and its change history. Documented rules, and a record of when they changed. This is the Govern function in the AI RMF and the documented-policy requirement in ISO/IEC 42001.
2. An inventory of what exists and what it can reach. The AI RMF's Map function, and the system description at the front of an ISO/IEC 42005 impact assessment. For agents this means the tools, credentials and data each one can touch — not a list of names.
3. A repeatable measurement method. The Measure function, and the evaluation evidence behind an impact assessment. Evaluators, datasets and experiments run against captured behaviour rather than against a spreadsheet of intentions.
4. A record of enforcement decisions. Which rule fired, on which call, with what outcome. Article 12 record-keeping and Article 14 human oversight land in the same artifact, and it only exists if something was evaluating at execution time.
5. A retention window that matches the obligation. The six-month floor in Article 26(6) is usually a configuration value rather than a code change. Check yours against the obligation you are actually under, before an assessor does.

How Waxell handles this

Waxell Compliance publishes the mapping between Waxell's policy categories and the two frameworks it maps against — NIST AI RMF at function level, and EU AI Act obligations at Articles 9, 12, 14, 15 and 26 — alongside the artifact each row produces. The page is deliberately explicit about what a mapping is not: it states that NIST AI RMF is voluntary and carries no certification scheme, and that the EU AI Act's conformity assessment applies to systems rather than to vendors. Waxell does not certify anyone, and corporate compliance status is published in the Vanta Trust Center rather than asserted in marketing copy.

The mechanism underneath is Waxell Policies: 50+ policy categories defined once in the governance plane and, in the page's own words, evaluated before execution proceeds — not logged after the fact. That ordering is what turns a control into evidence. A policy that fires produces the record that proves it fired.

Four distinct records come out of that, each owned by a different product. Waxell Observe produces execution traces — multi-agent parent and child span trees, OpenTelemetry-native. The Waxell MCP Gateway, included in Connect, produces the payload-free tool-call audit log: who called what tool, which decision applied, which rules fired, exportable as CSV. Waxell Connect produces the versioned, audited record of hand-offs between agents and people. Waxell Runtime produces the lineage causality graph of a single governed workflow run, with per-step checkpoints. Where an assessment asks what AI is running on employee machines rather than what an agent did, that inventory comes from Waxell Endpoints.

One practical note on the retention floor. Data retention on the published plans runs 14 days on Free, 30 days on Team, 90 days on Business and 365+ days on Enterprise. If your agents fall inside Article 26, six months is the number your plan has to clear.

FAQ

Which AI governance framework is legally required for AI agents?

Of the instruments above, the EU AI Act is the one that is law in its own right. It applies based on where an AI system is placed on the market and how it is classified, not on whether an organisation chose to adopt it. The NIST framework, the ISO/IEC standards and the OWASP lists become obligations through contracts, procurement requirements or sector regulators.

Do I need more than one framework?

Often, yes. A common pattern is ISO/IEC 42001 for the management system because customers ask for it, NIST AI RMF as the internal operating structure, the OWASP lists for engineering-level threat coverage, and the EU AI Act because a product ships into Europe. They layer rather than compete, and the underlying controls overlap heavily.

When do EU AI Act high-risk obligations apply to AI agents?

Regulation (EU) 2026/1744 sets 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III, and 2 August 2028 for AI embedded in products under Annex I. The original dates were 2 August 2026 for Annex III systems and 2 August 2027 for Annex I products. Confirm the current consolidated text before relying on any date in a planning document — this area has already moved once.

Can a vendor be certified against the NIST AI RMF?

NIST publishes the AI RMF for voluntary use, alongside a Playbook, a Roadmap and a Crosswalk; what it publishes does not include a certification or conformity-assessment scheme for the framework. A vendor can map its controls to the four functions and show you the evidence each control produces, which is a different thing from holding a certificate.

What does an assessor actually want to see for an AI agent?

The policy that was in force, the version history showing when it changed, the record of each decision that policy produced, and the identity the agent was acting under at the time. For agents, the last two are where programmes tend to be thin — an action is attributable only if something was resolving identity and recording the decision while the action was happening.

Sources

European Union, "Regulation (EU) 2024/1689 (Artificial Intelligence Act)" (EUR-Lex), 13 June 2024.

European Union, "Regulation (EU) 2026/1744 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI)" (EUR-Lex), signed 8 July 2026, published in the Official Journal 24 July 2026.

NIST, "AI Risk Management Framework" (nist.gov), AI RMF 1.0 released 26 January 2023.

NIST, "Announcing the AI Agent Standards Initiative for Interoperable and Secure Innovation" (nist.gov), 17 February 2026.

ISO/IEC, "ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system" (iso.org), December 2023.

ISO/IEC, "ISO/IEC 42005:2025 — Information technology — Artificial intelligence (AI) — AI system impact assessment" (iso.org), May 2025.

ISO/IEC, "ISO/IEC 23894:2023 — Information technology — Artificial intelligence — Guidance on risk management" (iso.org), February 2023.

OWASP Gen AI Security Project, "OWASP Top 10 for Agentic Applications for 2026" (genai.owasp.org), 9 December 2025.

OWASP Gen AI Security Project, "2025 Top 10 Risk & Mitigations for LLMs and Gen AI Apps" (genai.owasp.org).

Waxell, "AI Agent Compliance Evidence" (waxell.ai).

Originally published on the Waxell blog.

Frameworks describe the controls you should have. The record of them running is a different artifact, and it only exists if something was enforcing at the moment the agent acted. Start free with Waxell Observe and one governed MCP upstream at waxell.dev/signup.