Regulatory radar · Season 1 · Q4 2026
What changed for AI agents this quarter
The six regulatory and standards changes that matter most to enterprises running AI agents in Q4 2026, from the Ariana AEGIS Model regulatory register. Checked October 23, 2026. Ordered by how soon each one bites.
In force
C-R06 · US federal
NIST AI RMF stays the US baseline
Voluntary · no change this quarter
Still the shared vocabulary US buyers use in questionnaires. Each case file maps its control to a pillar first, then to the RMF function.
C-R04 · Standards
OWASP Top 10 for Agentic Applications (2026)
Published · in use now
Every case file now tags its failure with an ASI risk ID, so readers can answer vendor questionnaires in the same terms.
Next 6 months
C-R02 · US states
SB 26-189 replaces the Colorado AI Act (SB 24-205)
Effective Jan 1, 2027
A notice-based regime for consequential decisions. Relevant to the claims scenario: customers need to know when an automated system decided.
C-R03 · US states
California ADMT rules reach their compliance date
Compliance due Jan 1, 2027
Automated decision-making technology rules bring notice and opt-out duties. Case Files 00, 01 and 05 test them under Pillar 5.
6–18 months
C-R01 · EU
EU Digital Omnibus moves the high-risk clock
Annex III high-risk duties: Dec 2, 2027
Regulation (EU) 2026/1744 defers Annex III high-risk obligations. Case files keep the logging and oversight controls; the deadline shifts.
C-R05 · International
MAS Guidelines on AI Risk Management
Issued Oct 7, 2026 · first sections apply Oct 7, 2027, the rest Oct 7, 2028
Singapore's guidelines for financial institutions cover all AI, including agents. Useful benchmark for multinational banks reading Case File 0.
See how these changes play out in practice in the Season 1 case files, or read the seven pillars they map to.
Get the next quarter’s radar in Digital Business + Emerging Tech, the Frontier Newscast on LinkedIn.