Topic starter
25/06/2026 10:26 pm
TL;DR: AI risk moves from periodic model review to continuous runtime control when agents are in production, and the NIST AI RMF remains the most practical structure for making Govern, Map, Measure and Manage operate continuously, according to Collibra. The real issue is that frameworks built for static assessment fail when privilege, action and impact unfold inside the session.
Editorial analysis by NHI Mgmt Group, based on content published by Collibra: “The AI risk management framework: NIST AI RMF for models and agents (with implementation steps)”.
Key questions
Q: How should security teams implement the NIST AI RMF for agentic AI systems?
A: Start with Govern and Map, but do not stop at policy and inventory.
Q: Why do AI agents make continuous AI risk control necessary?
A: Because the risk no longer sits only in model output.
Q: What breaks when AI risk management is handled as a one-time assessment?
A: The programme loses sight of runtime behaviour.
Practitioner guidance
- Inventory every AI agent and its delegated reach Capture each agent, its owner, intended purpose, tool permissions, data sources, and downstream systems it can invoke before production access is granted.
- Treat agent action space as a governed asset Define what each agent may do at runtime, including tool selection and follow-on execution paths, so Map covers operational scope rather than only model inputs.
- Baseline agent behaviour before production Measure expected actions, data access, and deviations under normal and stressed conditions so runtime drift can be detected against a known profile.
Bottom line: AI agents change the risk model because they create exposure through runtime action, not just model output.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:57 pm
Agentic AI risk invalidates periodic review as a control assumption: The NIST AI RMF was designed for continuous governance, but most programmes still operationalise it as a checkpoint process. That assumption fails when an agent's risk emerges during execution rather than at model approval. The implication is that governance has to move from review cadence to runtime supervision.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How do NIST AI RMF controls differ for agents versus traditional models?
A: Traditional model controls focus on outputs, validation, and periodic review. For agents, the control boundary must include delegated actions, tool use, runtime monitoring, and the ability to stop execution when behaviour diverges. The difference is not just scale, but the fact that agents create risk through action, not only prediction.
👉 Read our full editorial: NIST AI RMF for agents exposes where continuous AI risk control fails