Thirteen regulatory frameworks.
One artifact.

OCC Bulletin 2026-13 revised interagency model risk management guidance but explicitly excluded generative and agentic AI from scope, on the basis that these technologies are "novel and rapidly evolving." The OCC's Spring 2026 Semiannual Risk Perspective then named agentic AI as a supervisory priority. Banks operate under both: a formal framework that excludes their agents, and active examination focus on those same agents. The agencies have signaled a forthcoming RFI specific to AI.

FinCEN's NPRM establishes an effectiveness mandate for AI-driven AML/CFT decisions: alert disposition, SAR filing, KYC. Mutable logs cannot demonstrate effectiveness. Examiners need cryptographic evidence of what authorized each decision and what inputs the model received.

NY-licensed fintechs and insurers face NYDFS enforcement risk for AI agent decisions without audit trails.

Article 12 requires automatic event logging with traceability appropriate to the intended purpose. For high-risk decisions, tamper-evidence is what gives logs evidentiary weight in regulatory or judicial proceedings.

Annex IV defines the 9-section technical documentation that providers of high-risk AI systems must prepare under Article 11 and retain for ten years under Article 18. This is a provider obligation. If you build or substantially modify a high-risk system, you become a provider under the Act and carry it. The bundle covers system design, data governance, performance metrics, risk management, lifecycle changes, applied standards, and post-market monitoring.

Article 22 governs automated decision-making affecting individuals and requires documented accountability.

CC6.1 maps to authorization_token_id. CC4.1 maps to execution_result. NIST AU-10 requires non-repudiation of principal actions.

SOC2 CC6.1 requires documented authorization controls for non-human identities. CC4.1 requires evidence of processing integrity.

CC8.1 requires that every change to a production system be authorized and approved before deployment, with documented attribution to an accountable individual. In 2026, AI-fluent auditors are requesting model registries with full version history alongside tested rollback procedures. They want every model promotion traced back to a named approver. None of this is formally codified in the Trust Services Criteria. Auditors are mapping AI risk to CC8.1 against working interpretations.

FDA's amended Part 820 took effect February 2, 2026 as the Quality Management System Regulation (QMSR), incorporating ISO 13485:2016 by reference. The regulation requires risk-based decisions across the quality management system, with documented evidence supporting each one. For AI medical device software, FDA's separate AI/ML guidance adds two layers on top: Good Machine Learning Practice for development discipline, and predetermined change control plans for pre-authorized model updates.

The proposed 2025 Security Rule amendments would significantly strengthen audit logging requirements for AI agent interactions with ePHI. Under the proposed amendments, every agent decision touching patient data would require a record of who authorized it, what input it received, and what it produced. Mutable logs do not satisfy this requirement.

Any AI system that creates or modifies GxP records must log which model version acted, on what input, producing what output, with a timestamp.

Colorado SB 26-189, signed May 14, 2026, replaces the original Colorado AI Act. It requires deployers of automated decision-making technology to give consumers notice when AI materially influences consequential decisions covering employment, housing, lending, healthcare, and legal services. Consumers have the right to appeal those decisions and to know what information the system used. The law takes effect January 1, 2027, with enforcement contingent on attorney general rulemaking. It is currently subject to a federal court challenge (xAI v. Weiser, with DOJ intervention) that could delay or narrow it.

Section 4 of the Executive Order directs the Attorney General to prioritize enforcement of federal criminal statutes against anyone who uses AI agents to unlawfully access data or information subsequently used for a criminal or unlawful purpose. No new criminal authority is created. The order sharpens enforcement of laws already on the books, including 18 U.S.C. 1028 (identity fraud), 1030 (computer fraud), and 1343 (wire fraud).