Govern and secure · Topic 12 of 14
AI agent governance: what the regulations and frameworks ask, and who signs for what
AI agent governance is the rules, owners and evidence a company uses to decide which agents may exist, what each may do and how it proves the agent stayed within those limits: a policy with a board owner, a register with named owners, a risk tier per use case, controls mapped to the laws, and logs that reconstruct each run.
In this guide: 83 pages
Key takeaways
- The EU AI Act is deferred for high-risk uses and still coming: the Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 Jul 2026, moved Annex III high-risk obligations to 2 Dec 2027 and Annex I to 2 Aug 2028, while the Article 50 transparency duties have applied since 2 Aug 2026 and name AI agents by example.
- Two US references changed in 2026. Colorado SB 26-189, signed 14 May 2026, repealed and re-enacted SB 24-205 with duties from 1 Jan 2027. SR 26-2 of 17 Apr 2026 replaced SR 11-7 for US banks and, in footnote 3, puts generative and agentic AI outside its scope, so banks govern agents through their broader risk practices.
- Singapore’s MAS Guidelines on AI Risk Management (final 7 Oct 2026) are supervisory guidelines that explicitly include AI agents and multi-agent systems in scope, with an inventory and risk assessment due within 12 months and full implementation within 24.
- The frameworks are stable: NIST AI RMF 1.0 with its Generative AI Profile (NIST AI 600-1), ISO/IEC 42001:2023 for the management system, and Singapore’s Model AI Governance Framework for Agentic AI (v1.5, 20 May 2026) as the first government framework written specifically for agents.
- This page is general information for IT leaders and developers and is no substitute for legal advice. The dates and article numbers are as the regulators’ pages showed them on 2 Nov 2026; confirm them with counsel before you build a compliance plan on them.
Why does agent governance matter now?
It matters now because the first duties that name agents are already in force and the next ones have fixed dates: EU transparency duties since 2 Aug 2026, Colorado from 1 Jan 2027, MAS inventories by 7 Oct 2027, EU high-risk obligations from 2 Dec 2027. Regulators expect governance to be demonstrable: logs and owners rather than a policy document. None of this is legal advice; it is the map an IT leader needs to brief counsel.
The European Commission’s explanation of the Article 50 transparency duties, published on 2 Aug 2026, gives "a chatbot, AI agent, and avatar" as examples of systems that must tell people they are dealing with AI, with fines up to 15 million euros or 3% of worldwide annual turnover. The Commission’s draft guidelines on high-risk classification (19 May 2026, consultation to 23 Jun 2026) add that "complex systems made up of several AI components, including so-called agentic AI systems, must be assessed holistically", and that a component doing only a narrow procedural or preparatory task may still be classified as high-risk. The draft was reported by Covington on 11 Jun 2026; its final status was unverified on 2 Nov 2026.
In the United States the federal position is deregulatory and the states still legislate. Executive Order 14365 (11 Dec 2025) directed the Justice Department to form a litigation task force and Commerce to list onerous state laws, and preempts nothing; Texas TRAIGA (effective 1 Jan 2026), the California CPPA regulations (automated decision-making compliance from 1 Jan 2027) and Colorado SB 26-189 (duties from 1 Jan 2027) still apply. Since 29 Sep 2026, Executive Order 14434 directs federal agencies to write "Super Intelligence" instead of "AI"; it changes terminology only.
Agents raise the bar on evidence. The MAS response to feedback of 7 Oct 2026 says monitoring of agentic AI "should extend, where relevant, to information flows and decision-making paths across workflows that use AI, such as reasoning processes, actions taken, and tools used". The NIST and UK AISI hijacking evaluation (17 Jan 2025) lifted attack success on held-out tasks from 11% to 81%, so governance has to be tested rather than assumed.
Which frameworks apply: NIST AI RMF, its GenAI profile and ISO/IEC 42001?
Three frameworks carry most enterprise programmes: NIST AI RMF 1.0 for the vocabulary, its Generative AI Profile for generative-specific risks, and ISO/IEC 42001:2023 for the management system an auditor can assess. Two newer documents are written for agents: Singapore’s IMDA framework and the NIST agent standards work.
Frameworks and standards, their status on 2 Nov 2026 and what each asks of a company that deploys agents.
| Framework | Status | What it asks of an agent deployer |
|---|---|---|
| NIST AI RMF 1.0 (26 Jan 2023) | Final; being revised under the July 2025 AI Action Plan, no date given | Govern, Map, Measure, Manage; the baseline most US programmes map to |
| NIST AI 600-1, Generative AI Profile (26 Jul 2024) | Final | Generative-specific risks and actions; Texas TRAIGA gives a defence for substantial compliance |
| ISO/IEC 42001:2023 | Published; certifiable | An AI management system with policy, roles, risk treatment and Annex A controls |
| ISO/IEC 42005:2025 | Published May 2025 (iso.org blocked automated checks) | A method for AI system impact assessment before deployment |
| CSA AI Controls Matrix v1 (9 Jul 2025) | Published; v1.1 current per CSA | 243 controls in 18 domains mapped to ISO/IEC 42001, NIST AI 600-1 and the EU AI Act |
| IMDA Model AI Governance Framework for Agentic AI (v1.0 22 Jan 2026; v1.5 20 May 2026) | Published, voluntary | Bound the risks upfront, make humans accountable, implement controls and processes, enable end-user responsibility; extend identity to agents |
| NIST AI Agent Standards Initiative (Feb 2026) | Active; draft work only, no finished deliverables listed | Coming US standards on agent identity, authorisation and security evaluation |
A vendor certificate is an input to your own assessment. Microsoft lists Copilot Studio and Microsoft Foundry in scope of its ISO/IEC 42001 certification and says customers remain responsible for engaging an assessor; AWS announced accredited certification covering Amazon Bedrock on 25 Nov 2024, and Anthropic on 13 Jan 2025.
What does the EU AI Act ask of AI agents after the Digital Omnibus?
The EU AI Act classifies by use rather than by technology, so an agent falls into the prohibited, high-risk, transparency or minimal tier according to what it does; the Digital Omnibus moved only the high-risk dates. The timeline below is as the Commission’s page showed it on 2 Nov 2026 (updated 19 Oct 2026).
EU AI Act dates for agent deployers after the Digital Omnibus.
| Date | What applies | Status on 2 Nov 2026 |
|---|---|---|
| 1 Aug 2024 | Regulation (EU) 2024/1689 enters into force | In force |
| 2 Feb 2025 | Prohibited practices (Article 5) and AI literacy (Article 4, softened by the Omnibus) | Applies |
| 2 Aug 2025 | General-purpose AI model obligations, mostly on model providers | Applies |
| 27 Jul 2026 | Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force (Official Journal 24 Jul 2026) | In force |
| 2 Aug 2026 | Article 50 transparency; AI Office enforcement powers; general application | Applies |
| 2 Dec 2026 | New prohibition (non-consensual intimate imagery, child sexual abuse material); marking grace period ends | Upcoming |
| 2 Dec 2027 | High-risk obligations for Annex III uses: logging (Article 12), oversight (Article 14), deployer duties (Article 26); moved from 2 Aug 2026 | Upcoming, deferred |
| 2 Aug 2028 | High-risk obligations for Annex I product-embedded systems; moved from 2 Aug 2027 | Upcoming, deferred |
The Cloud Security Alliance’s research note of 1 Aug 2026 calls the Omnibus "Deferred, Not Cancelled", which is the right reading. The sub-page on the EU AI Act and AI agents takes the duties article by article.
What do US states and sector regulators ask?
US states regulate automated decisions about people, and sector regulators regulate the risk practices of banks and insurers; our research found no law in either written specifically for agents, so an agent inherits the duties of the decision it influences. The table lists the instruments that changed in 2025 and 2026.
US state and sector instruments relevant to agents, as of 2 Nov 2026.
| Instrument | Status and dates | What it means for an agent |
|---|---|---|
| Colorado SB 26-189, Automated Decision-Making Technology | Signed 14 May 2026; repeals and re-enacts SB 24-205, which never took effect; duties from 1 Jan 2027; attorney general enforcement, 60-day cure until 1 Jan 2030; no private right of action | An agent that materially influences a consequential decision needs notice, a plain-language explanation within 30 days of an adverse outcome, correction and human review rights, and records kept at least 3 years |
| Texas HB 149, TRAIGA | Effective 1 Jan 2026; attorney general enforcement, 60-day cure | Disclosure by agencies and health care providers; a defence for substantial compliance with NIST AI 600-1 |
| California CPPA regulations on ADMT, risk assessments and audits | Effective 1 Jan 2026; ADMT compliance from 1 Jan 2027; attestations due 1 Apr 2028 | Agents making significant decisions about consumers fall under the automated decision-making rules |
| Federal Reserve, OCC and FDIC SR 26-2 (17 Apr 2026) | Final; supersedes SR 11-7 (2011) and SR 21-8; most relevant to banks with over 30 billion dollars in total assets | Footnote 3: "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance." Banks govern agents through their broader risk practices |
| MAS Guidelines on AI Risk Management (Singapore) | Final 7 Oct 2026; inventory and risk assessment within 12 months, full implementation within 24 | AI agents and multi-agent systems in scope; board oversight; monitoring across reasoning, actions and tools |
Two citations to retire: "we follow SR 11-7" no longer answers a supervisor’s question about a bank’s agents, and SB 24-205 duties were never live law.
What does a working operating model look like?
A working operating model names a board-level owner, treats every agent as a governed asset with an owner and an identity, tiers each use case by the decision it influences, bounds autonomy, keeps oversight real and produces logs that answer an auditor. Each element names the instrument that asks for it.
- Policy and board ownership. ISO/IEC 42001 is the management-system standard; MAS expects board oversight of AI risk and board approval of key frameworks; OMB M-25-21 requires Chief AI Officers in federal agencies.
- A register that treats each agent as an asset. MAS expects an accurate, up-to-date inventory within 12 months, with agents and multi-agent systems in scope.
- Risk tier per use case, assessed as one system. Under the EU AI Act the tier follows the use; the Commission’s draft guidelines assess agentic systems holistically. Colorado tiers by whether the technology materially influences a consequential decision.
- Impact assessment before deployment. ISO/IEC 42005:2025 gives the method; the California CPPA regulations require risk assessments; OMB M-25-21 requires pre-deployment testing for high-impact federal AI.
- Bounded autonomy by design. IMDA asks for limits on tools, permissions and autonomy set upfront, approval checkpoints at irreversible actions, and identity management extended to agents so that each has an accountable owner.
- Map each control once to several frameworks: NIST AI RMF and AI 600-1, ISO/IEC 42001 Annex A and the EU AI Act articles, with the CSA AI Controls Matrix as a ready crosswalk, so that one audit trail serves every assessor.
- Human oversight that is real. EU AI Act Article 26(2) requires people with the necessary competence, training and authority; IMDA asks for regular audits of whether approval still works.
- Transparency notices. Article 50 since 2 Aug 2026; Texas disclosure duties; Colorado notice from 1 Jan 2027.
- Vendor oversight. SR 26-2 section VII on third-party products, applied by analogy since its scope excludes agents; vendor ISO/IEC 42001 certificates as inputs to your own assessment.
What must the audit trail contain?
The audit trail must let someone reconstruct, for each agent run, who or what acted, on whose behalf, which tools and data it used, what it produced and who approved it, kept for the longest period any applicable rule sets. The table maps each requirement to the telemetry that satisfies it.
Audit trail requirements mapped to agent telemetry.
| Requirement | What it asks | Telemetry that satisfies it |
|---|---|---|
| EU AI Act Article 12 (high-risk providers; 2 Dec 2027 Annex III, 2 Aug 2028 Annex I) | Automatic recording of events over the system’s lifetime | A trace per run: run id, timestamps, model and prompt version, tool calls with arguments and results, sources, output, errors |
| EU AI Act Articles 19(1) and 26(6) | Logs kept at least six months unless other law says otherwise | Six-month minimum retention on the trace store, with legal hold |
| EU AI Act Articles 14 and 26(2) | Effective human oversight by competent people | Approval events in the trace: approver, what they saw, decision, time; overrides and stops |
| EU AI Act Article 26(5) | Deployers monitor and suspend use when a risk appears | Runtime alerts, kill-switch and suspension events logged |
| Colorado SB 26-189 (from 1 Jan 2027) | Compliance records kept 3 years; the technology’s role explained within 30 days of an adverse outcome | A decision record linking person, agent output, reviewer and final decision; 3-year retention |
| MAS Guidelines on AI Risk Management (7 Oct 2026) | Monitoring across reasoning, actions and tools, to pinpoint failures across chains of agents | Distributed tracing across agents (parent and child spans), tool-call logs |
| IMDA agentic framework v1.5 | Records of agent actions, decisions and interactions across all components | The same, plus an identity per agent so each action is attributable |
| Microsoft Purview (a product feature rather than a legal requirement) | Prompts and responses in the unified audit log; retention policies apply | Purview Audit, eDiscovery and retention for Copilot, Copilot Studio and Foundry agents |
The common gaps: no stable identity for the acting agent, tool-call arguments never captured, approvals never recorded, sub-agent calls not linked to the parent run, retention shorter than six months or three years. The opposite failure exists too: prompts full of personal data logged without minimisation or access control.
How do Microsoft, AWS and Google implement it?
The governance and evidence tooling each cloud offered on 2 Nov 2026, with statuses as the vendor pages showed them.
Capability, Microsoft, AWS, Google
| Capability | Microsoft | AWS | |
|---|---|---|---|
| Compliance templates | Purview Compliance Manager templates for the EU AI Act, ISO/IEC 42001:2023, ISO/IEC 23894:2023 and NIST AI RMF 1.0 | Audit Manager Generative AI Best Practices Framework v2, frozen: maintenance mode from 30 Apr 2026; AWS points to the Config conformance pack for AI and ML | ISO/IEC 42001 page exists; content not verified |
| Agent inventory and control plane | Microsoft Agent 365 (generally available 1 May 2026) | AWS Agent Registry with approval workflow (generally available 31 Aug 2026) | Agent Registry and Agent Gateway (generally available 18 Jun 2026) |
| Audit log of agent activity | Purview unified audit log for Copilot, Copilot Studio, Foundry and Entra-registered AI apps; retention and eDiscovery | CloudTrail for AgentCore and registry actions; AgentCore Observability traces on CloudWatch | Agent Observability (generally available 18 Jun 2026); Cloud Audit Logs |
| Vendor ISO/IEC 42001 certificate | Copilot Studio, Microsoft Foundry, Microsoft Copilot, GitHub Copilot and Security Copilot in scope; certificates on the Service Trust Portal | Accredited certification announced 25 Nov 2024, initially covering Amazon Bedrock; current scope in AWS Artifact | Page exists; scope not verified |
Google Cloud’s ISO/IEC 42001 and governance pages did not render for the research pass, so the Google column states only what was verified.
When is a governance programme the wrong first move, and what goes wrong?
Do not start with a framework crosswalk if you cannot yet list your agents; the register comes first. Do not wait for the 2027 EU dates to add logging, because the transparency duties and the state laws are already live. Once the programme runs, these are the failures we see.
Reading the Omnibus as a delay of the whole Act
Only the high-risk chapters moved. Prohibitions, general-purpose model duties, Article 50 transparency and the new prohibition of 2 Dec 2026 are on schedule.
Classifying the model instead of the agent system
The Commission’s draft guidance looks at the combined system. A component that only prepares a hiring or credit decision may still be classified as high-risk, and with it the workflow it feeds.
Citing dead or replaced law
SB 24-205 never took effect; SB 26-189 replaced it. SR 11-7 was superseded by SR 26-2, which excludes generative and agentic AI from its scope.
Treating a vendor certificate as your compliance
An ISO/IEC 42001 certificate covers the vendor’s management system for named services; Microsoft’s own page says the customer remains responsible for engaging an assessor.
Logs that cannot answer the auditor
No stable identity for the acting agent, tool-call arguments not captured, approvals not recorded, sub-agent calls not linked to the parent run, retention shorter than the rule. Each is cheap to fix before launch.
Decorative human oversight
IMDA names automation bias and asks for regular audits of whether human approval still works. An approver who clicks through hundreds of items an hour is a sign that oversight has stopped being effective, and should trigger a review.
What should you set up?
The controls that turn a policy into a programme an assessor can test, in the order we install them.
- A written AI policy with a board-level owner and a named accountable executive, mapped to ISO/IEC 42001 clauses.
- A register of every agent with owner, sponsor, identity, platform, tools and data reached, risk tier, approval state and review date.
- A risk tiering rule that classifies the use rather than the model: EU AI Act tier, whether the agent influences a consequential decision under Colorado or California rules, and the sector rule.
- An impact assessment (ISO/IEC 42005 method) before any tier that touches people, credit, employment, health or safety.
- Autonomy limits per tier: tools, permissions and spend caps set upfront, approval checkpoints at irreversible actions, and a tested stop.
- Transparency notices in every agent that talks to people (EU Article 50, since 2 Aug 2026), and Colorado notice for covered automated decisions from 1 Jan 2027.
- A trace per run with the fields in the audit table, retained at least six months where the EU high-risk log duty applies and three years where Colorado compliance records apply, with prompts access-controlled.
- A quarterly review of oversight effectiveness, vendor certificates and the regulatory calendar, with the next EU dates on it.
Enterprise example · Worked example · illustrative
An insurer with 9,000 staff tiers 24 agents against three rulebooks
Illustrative scenario. A European insurer with 9,000 employees, operations in Germany and a US subsidiary with Colorado customers, 24 agents on Copilot Studio and Microsoft Foundry, and a board that asked for one answer to "which rules apply to our agents?"
The compliance team started with the register. The Agent 365 registry listed the 24 agents; nine had no sponsor and four had no documented purpose. Each got an owner, a sponsor and a purpose line before anything was classified.
Classification followed the use. Eighteen agents answered policy questions for staff or customers: transparency tier, so each got a disclosure that the user is talking to an AI system. Four agents prepared claims assessments that a human adjuster signed; counsel treated them as Annex III candidates and scheduled the Article 12 logging and Article 14 oversight work well before 2 Dec 2027. Two agents screened job applications in the US subsidiary: a preparatory component fed a hiring decision, so counsel applied the Commission’s holistic reading for the EU side and the Colorado SB 26-189 duties for the US side, ready for 1 Jan 2027.
The evidence layer was built once. Foundry tracing and the Purview unified audit log fed one trace store with run id, model and prompt version, tool calls with arguments, sources, output and approver identity. Retention was set at three years, which met the EU minimum and the Colorado record rule in one setting; prompts were access-controlled and personal data minimised at ingestion.
Oversight was tested rather than declared. For the claims agents, the team sampled approvals monthly and measured how often adjusters changed the agent’s proposal; a change rate near zero triggered a review, following IMDA’s advice on automation bias. The board received one page: 24 agents, their tiers, the dates that applied, the owner of each, and the two agents retired because nobody could state their purpose.
- Owner
- A named owner and a business sponsor per agent in the Agent 365 registry; an accountable executive for the programme
- Identity
- Microsoft Entra Agent ID per agent; Conditional Access for agents; no shared service accounts
- Risk tier
- EU AI Act tier by use (transparency or Annex III candidate), plus a Colorado consequential-decision flag
- Approval
- Requests queue in the Microsoft 365 admin center; Annex III candidates need an impact assessment and an evaluation gate
- Oversight
- Human sign-off on claims and hiring outputs; monthly sampling of approvals with a change-rate trigger
- Audit trail
- Foundry tracing and the Purview unified audit log in one store; three-year retention; prompts access-controlled
- Transparency
- AI disclosure in every customer- and staff-facing agent; Colorado notice ready for 1 Jan 2027
- Retirement
- Two purposeless agents blocked and deleted with the 30-day recovery window; identities disabled; traces archived
How do you start?
- List the agents. Export every registry and inventory you run and give each agent an owner before you classify anything.
- Write down which rulebooks apply: EU AI Act tiers, the US states where you make decisions about people, your sector regulator, MAS if you operate in Singapore.
- Classify each agent by its use and the decision it influences, with counsel; mark the Annex III candidates and the consequential-decision agents.
- Turn on the trace and the retention now. The transparency duties and the state laws are live; the EU high-risk dates are fixed.
- Add the disclosure to every agent that talks to people.
- Map your controls once to NIST AI RMF, ISO/IEC 42001 and the EU AI Act articles.
- Put the dates on a calendar: 2 Dec 2026, 1 Jan 2027, 7 Oct 2027 for MAS inventories, 2 Dec 2027 and 2 Aug 2028. Review after each.
Frequently asked questions
Is the EU AI Act delayed?
Only the high-risk obligations are. Regulation (EU) 2026/1744, in force since 27 Jul 2026, moved Annex III duties to 2 Dec 2027 and Annex I duties to 2 Aug 2028. Prohibitions, general-purpose model duties and Article 50 transparency already apply, and a new prohibition applies from 2 Dec 2026.
Does an AI agent have to tell people it is an AI?
In the EU, yes, since 2 Aug 2026 under Article 50, and the Commission names "a chatbot, AI agent, and avatar" as examples. In the US, Texas requires disclosure by agencies and health care providers, and Colorado requires notice for covered automated decisions from 1 Jan 2027.
Does SR 11-7 still apply to a bank’s AI agents?
SR 11-7 was superseded on 17 Apr 2026 by SR 26-2, issued by the Federal Reserve, OCC and FDIC. Footnote 3 of SR 26-2 puts generative and agentic AI models outside its scope and says a bank’s broader risk management and governance practices should determine the controls for them. Its principles still apply to traditional and non-generative models.
Is Colorado’s AI Act in force?
The 2024 law, SB 24-205, never took effect. SB 26-189 repealed and re-enacted it on 14 May 2026 as an automated decision-making law, with duties from 1 Jan 2027, attorney general enforcement with a 60-day cure until 1 Jan 2030, three-year records and no private right of action.
How long must we keep agent logs?
It depends on the rule. The EU AI Act asks providers and deployers of high-risk systems to keep automatically generated logs for at least six months unless other law says otherwise, and Colorado SB 26-189 requires compliance records for at least three years. Set the trace store to the longest period that applies.
Can we rely on this page for compliance decisions?
No. It is general information for IT leaders and developers, with dates and article numbers as the regulators’ pages showed them on 2 Nov 2026. Use it to brief counsel and plan the controls, and confirm every obligation with a lawyer.
In this topic
Sources
Each source was read on 2 November 2026. The date shown is the date on the page, or the page’s ms.date for Microsoft Learn; an undated page shows the date it was read.
- AI Act: regulatory framework for AI
- Safer and more transparent AI
- Regulation (EU) 2026/1744, Digital Omnibus on AI (Official Journal)
- European Parliament position P10_TA(2026)0198 on the Digital Omnibus on AI
- Artificial intelligence: Council gives final green light to simplify and streamline rules
- EU Digital Omnibus on AI enters into force
- CSA research note: EU AI Act high-risk deadline and the Omnibus, "Deferred, Not Cancelled"
- EU AI Act update: the European Commission publishes draft guidelines on high-risk AI systems
- EU AI Act Article 12, record-keeping (reading aid)
- EU AI Act Article 26, obligations of deployers (reading aid)
- EU AI Act Article 19, automatically generated logs (reading aid)
- EU’s AI rules face first enforcement test over lab incidents
- AI Risk Management Framework
- AI Agent Standards Initiative
- Control Overlays for Securing AI Systems (COSAiS, renamed COSIS)
- Technical blog: strengthening AI agent hijacking evaluations
- SR 26-2: Revised Guidance on Model Risk Management
- SR 26-2 attachment: Revised Guidance on Model Risk Management
- SB26-189: Automated Decision-Making Technology
- HB 149, Texas Responsible Artificial Intelligence Governance Act (enrolled text)
- CPPA announces approval of regulations on ADMT, risk assessments and cybersecurity audits
- Executive Order 14365: Ensuring a National Policy Framework for Artificial Intelligence
- Executive Order 14434: Inaugurating the Era of Super Intelligence
- White House releases new policies on federal agency AI use and procurement (M-25-21, M-25-22)
- Guidelines on Artificial Intelligence Risk Management: consultation paper and response to feedback
- New Model AI Governance Framework for Agentic AI
- Model AI Governance Framework for Agentic AI, version 1.5
- SS1/23: Model risk management principles for banks
- AI Controls Matrix
- ISO/IEC 42001:2023 Artificial Intelligence Management System standards (Microsoft compliance offering)
- Regulations in Compliance Manager
- Microsoft Purview data security and compliance protections for generative AI apps
- Microsoft Agent 365 overview
- AWS Audit Manager availability change
- AWS achieves ISO/IEC 42001:2023 accredited certification
- AWS Responsible AI resources (AI Service Cards)
- AWS Agent Registry now generally available
- Anthropic achieves ISO 42001 certification for responsible AI
- Gemini Enterprise Agent Platform release notes
Planning an AI program?
Talk to the team that builds it and runs it after launch.
- Built to SOC 2, HIPAA and GDPR standards
- EU AI Act-aligned delivery
- Microsoft Solutions Partner