For most of the last two years, AI governance lived in documents: model cards, acceptable-use policies, a risk register in a GRC tool. In 2026 the deadlines caught up with the documents. The EU AI Act's provisions on prohibited practices, transparency, and general-purpose models became enforceable, with the AI Office and member-state authorities empowered to act from August 2. Unlike the voluntary NIST AI RMF, the AI Act is mandatory and carries penalties. A spreadsheet that asserts a control exists is no longer the same thing as the control existing.
What reviewers will actually ask
The through-line in the 2026 guidance is that compliance controls have to reach runtime, with intervention and continuous record-keeping. After August 2, organizations operating high-risk systems should assume a reviewer will ask how risk is managed across the lifecycle, how a human can understand and interrupt the system's operation, how automatic logs support traceability and post-market monitoring, and how deployers monitor live behavior. Every one of those questions is answered by a running system emitting evidence — not by a policy PDF.
There is also a quieter requirement that trips people up: your AI inventory has to include agents. An agent nobody registered is simultaneously a governance gap and a compliance gap, because you cannot manage, interrupt, or log a system you have not enumerated. Shadow AI is not just a security problem in this framing; it is a regulatory one.
NIST moves to agents
On the technical side, NIST's February 2026 AI Agent Standards Initiative is significant because of what it names. The request for information explicitly covers indirect prompt injection, data poisoning, specification gaming, and governance controls — the same runtime failure modes that showed up in this year's incidents, now being drawn into standards work. When the framework everyone maps to starts describing injection and specification gaming as first-class concerns, “we have a policy” stops being a sufficient answer and “here is the evidence the control operated” becomes the expectation.
Framework mappings and policy packs feed evaluation. What satisfies a reviewer is the evidence that a control actually fired at runtime — not the mapped row itself.
The 2026 rules reward the same pipeline good security already needs: discover every agent (including shadow AI), enforce controls at runtime, emit durable evidence, and compute readiness against the framework — not the other way round.
How to be ready without faking it
The wrong response to a deadline is a fresh binder of attestations. The right one is to make the runtime produce the evidence a reviewer wants, and to be honest that a mapped control is an input, not a certificate. That is the discipline Intertrace is built around, and it lines up cleanly with what the 2026 rules ask for.
- Inventory the agents: discover and register the AI systems actually running, including the ones no one filed a ticket for, so governance and compliance both have something to point at.
- Put controls at runtime: enforce policy where the agent acts — classification, tool authorization, egress control — so “intervention” is a real capability and not a paragraph.
- Keep records that survive review: emit durable events for decisions — what was denied, by which policy, for which tenant, when — because traceability and post-market monitoring are evidence requirements, not nice-to-haves.
- Compute readiness from that evidence: treat OWASP and NIST mappings as inputs to evaluation, and let the readiness number fall out of what the runtime actually did, so you are never defending a green cell you cannot substantiate.