The regulatory frameworks that most often apply to AI agent deployment, mapped to Agent Shield’s controls. The mappings are self-assessed; none is a certification.
A tamper-evident decision trail for AI agent actions in financial systems, for your SOX controls testing. There is no SOX-specific report yet.
Controls mapped for AI agents operating in UK regulated firms.
High-risk duties apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I) under Regulation (EU) 2026/1744. Agent Shield maps its controls to the Act’s articles and produces evidence for the ones it covers.
Scope limits and an audit trail for AI agents that touch protected health information. No HIPAA-specific report or BAA document is generated.
Controls mapped to the international standard for artificial intelligence management systems.
Article 22 automated decision-making audit trails and data governance for AI agent operations.
Hosted service. No contractual SLA is offered yet, and Agent Shield holds no SOC 2 or ISO 27001 certification. Data residency options (UK, EU, US) are planned.
The engine ships as a container image that runs with Postgres and Redis, so it can run inside your infrastructure. The optional LLM tier calls an external model provider; air-gapped operation is not yet supported.
Bearer API keys, with rotation. Optional Ed25519 request signing for agents that register a key. Every decision is recorded, with a minimised payload.
Independent third-party penetration testing planned with CREST-certified assessors, with results shared with enterprise design partners. Responsible disclosure programme in place.
Article-by-article mapping for high-risk AI systems, self-assessed. Where an article is outside what a governance plane can do, the table says so. Transparency duties apply from 2 August 2026; high-risk duties from 2 December 2027 (Annex III) and 2 August 2028 (Annex I), under Regulation (EU) 2026/1744.
| Article | Requirement | Status |
|---|---|---|
| Art. 9 | Risk management system — continuous identification, analysis, and mitigation of risks throughout the AI system lifecycle | Mapped |
| Art. 10 | Data governance — training, validation, and testing data sets subject to appropriate data governance and management practices | Not covered (model training data) |
| Art. 11 | Technical documentation — drawn up before the system is placed on the market, kept up to date throughout its lifetime | Not covered |
| Art. 12 | Record-keeping — automatic logging of events during the high-risk AI system’s operation, traceable and verifiable | Mapped |
| Art. 13 | Transparency — operation sufficiently transparent to enable deployers to interpret the system’s output and use it appropriately | Mapped |
| Art. 14 | Human oversight — designed to be effectively overseen by natural persons, including appropriate human-machine interface tools | Mapped |
| Art. 15 | Accuracy, robustness, and cybersecurity — designed to achieve an appropriate level of accuracy, robustness, and cybersecurity | Mapped |
| Art. 17 | Quality management system — providers shall put in place a quality management system ensuring compliance with this Regulation | Mapped |
Agent Shield is the reference implementation of the AGS v3.1 standard, published by AgentGoverning. AGS v3.1 has 841 dimensions across 101 landscapes; Agent Shield ships 783 of them, and the AGS benchmark tests 26 against the engine.
This section used to report 600 adversarial attacks from GPT-4o, Gemini 2.5 Flash and Grok-3, a 99.9% detection rate and zero bypasses. Those runs counted an escalation or an error response as a block and recorded no false-positive rate, so they did not measure detection, and the figures are withdrawn. A new figure will come only from a run through the live endpoint that counts blocked, held and approved separately and reports its false-positive rate. Benchmark status
Agent Shield is designed to help you evidence your controls under the EU AI Act. Request a governance assessment for your agent fleet.
Built to be ready before the regulators arrive.