{"slug": "model-risk-governance-for-agentic-ai-sr-11-7-nist-and-iso-compared", "title": "Model Risk Governance for Agentic AI: SR 11-7, NIST, and ISO Compared", "summary": "The Federal Reserve's SR 11-7 model risk management framework, built on deterministic model assumptions, breaks down for agentic AI systems that plan, call tools, and act through multi-step reasoning, shifting risk from prediction error to action risk, decision-chain risk, and goal misalignment. The article compares SR 11-7 with NIST AI RMF and ISO/IEC 42001, noting that SR 26-2 excludes generative and agentic AI from model-risk scope, leaving a governance gap that consumer-protection, fair-lending, and third-party-risk obligations still cover. It distinguishes AI risk assessments from traditional cybersecurity audits, emphasizing that audits prove controls exist while assessments prove agent behavior is safe, and highlights OSFI's concerns about over-privileged access, shared credentials, tool chaining, and weak traceability.", "body_md": "For more than a decade, [model risk management](https://www.alation.com/blog/model-risk-management/) under [SR 11-7](https://www.federalreserve.gov/supervisionreg/srletters/sr1107.htm) has rested on three pillars: sound development, independent validation, and ongoing monitoring under effective governance. Each pillar assumes the model is deterministic: same input in, same output out. That assumption underpins the discipline, and it is what agentic AI breaks.\n\nAgentic systems do not work that way. They plan, call tools, retrieve data and act through multi-step reasoning with limited per-step human approval, so the same input can produce different outcomes. The risk shifts from a wrong prediction to a wrong action, a cascading decision chain, or a goal badly specified from the start.\n\nThis article is part of a wider look at the [full rogue agent risk cluster](/ai-model-risk-and-rogue-agents-when-safety-testing-becomes-the-safety-risk). By the end you will know why agentic AI breaks SR 11-7’s assumptions, what a behavioural assessment checks that an audit does not, and how to choose between NIST AI RMF and ISO/IEC 42001.\n\n## Why do traditional model risk management frameworks break down for agentic AI?\n\nSR 11-7’s three pillars were written for models that are reproducible and consistent. Agentic AI is neither, so a framework built to validate a stable model object ends up validating the wrong thing.\n\nThe principles still apply to agents; what has to change is the operational layer underneath them. The risk object moves from a reproducible model output to a decision-and-action path. Risk expands from prediction error to action risk (the action can be wrong even when reasoning is sound), decision-chain risk (a small early error propagates downstream), and goal misalignment (an agent told to cut resolution time closes cases early).\n\nBehavioural drift compounds it: behaviour can shift for reasons that never show up in a code repository. The model you validated in March is not necessarily the model running in June.\n\n[SR 26-2 calls generative and agentic AI “novel and rapidly evolving”](https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm) and leaves it outside model-risk scope, which does not make agentic systems ungoverned. That carve-out moves them into a gap your program now owns in the broader AI model risk and rogue agents picture, while consumer-protection, fair-lending and third-party-risk obligations still apply. Ungoverned agents have failed in production, as the [July 2026 escape showed](/what-happened-when-ai-models-escaped-safety-testing-in-july-2026).\n\n## AI risk assessment vs traditional cybersecurity audit: what’s the difference?\n\nThe natural first response to that gap is to treat agentic AI as an audit-and-compliance problem, but an audit proves the perimeter and leaves the behaviour unexamined.\n\n[A cybersecurity audit confirms the perimeter](https://orca.security/resources/blog/nist-ai-risk-management-framework-ai-rmf/), configuration, access controls and compliance. An AI risk assessment examines model behaviour, data flows, tool access and non-deterministic outcomes. Neither replaces the other: an audit proves controls exist while an assessment proves the agent’s behaviour is safe.\n\nAgentic AI widens the surface with decision-path traces (the step-by-step record of how an agent reached an action), tool calls, [Model Context Protocol](https://modelcontextprotocol.io/) (MCP) servers, prompt injection and data leakage, [all beyond what a standard audit was designed to judge](https://validmind.com/blog/ai-risk-management-framework-agentic-systems/). [OSFI’s bulletin](https://www.osfi-bsif.gc.ca/en/risks/technology-cyber-risk-management/technology-risk-bulletin/generative-agentic-artificial-intelligence-implications-technology-cyber-security-operational) flags over-privileged access, shared credentials, tool chaining and weak traceability as reasons outcomes slip out of control, so test whether each control fires.\n\nFor an agentic system, the core questions are how much it can do on its own and what happens when it goes wrong. Assess the whole system across autonomy, impact, controls, monitoring and accountability. It is the same lens for working out [whether your deployment is vulnerable to rogue agent behaviour](/assessing-and-defending-ai-deployments-against-rogue-agent-behaviour).\n\n## How do you extend model risk management (SR 11-7) to agentic AI systems?\n\nWith the audit-only fix ruled out, the practical path is to re-operationalise the existing model-risk pillars around behaviour: inventory becomes continuous AI asset discovery, validation becomes decision-path soundness, and monitoring becomes continuous evaluation of prompts, tools and model versions.\n\nThe first shift is from a static registry to a living model inventory. Manual registration misses agents that enter through internal teams, vendor platforms, SaaS updates and low-code tools; continuous discovery surfaces [shadow AI nobody registered](https://www.thedataexperts.us/banking-ai-governance/) before it causes harm.\n\nThe second shift is from formula validation to decision-path validation. For a deterministic model you validate the formula. For an agent, the validation object is the decision-path trace: what the agent reasoned, which tools it called, and what data it retrieved. Without that depth you cannot tell whether a bad outcome came from faulty retrieval, a tool misfire, or a reasoning error mid-chain.\n\nThe third shift is expanding what counts as a material change. Prompt edits, tool additions, MCP server changes and LLM provider version updates all count.\n\nIn practice, [Arthur.ai](https://www.arthur.ai/blog/model-risk-management-in-the-age-of-agentic-ai) covers continuous discovery and decision-path traces, while [Mindgard’s five-step approach](https://mindgard.ai/blog/how-to-conduct-an-ai-risk-assessment) spans scope definition, AI asset inventory, likelihood-times-impact ranking, prioritised remediation and continuous monitoring. Both are vendor-sourced and not neutral, so treat them as guidance rather than assurance.\n\n## NIST AI RMF vs ISO/IEC 42001: which framework should you adopt?\n\nOnce SR 11-7’s pillars are redirected at behaviour, the remaining decision is which governance framework to layer on top.\n\nNIST AI RMF is a voluntary framework organised around Govern, Map, Measure and Manage. [NIST published AI RMF 1.0 in January 2023](https://www.nist.gov/itl/ai-risk-management-framework), with playbooks and profiles but no certification. [ISO/IEC 42001](https://www.iso.org/standard/81230.html) is a certifiable AI management system built on Plan-Do-Check-Act Clauses 4 to 10, with an AI system impact assessment and [ISO/IEC 23894](https://www.iso.org/standard/77304.html) alongside it for risk management.\n\nAdoption is divided: [Stanford HAI’s AI Index](https://hai.stanford.edu) reports 36% of organisations cite ISO/IEC 42001 and 33% cite NIST AI RMF as an influence on their AI risk management.\n\nThe choice comes down to context. [Regulated or audit-heavy organisations lean towards ISO/IEC 42001](https://www.wolterskluwer.com/en/expert-insights/key-differences-between-iso-42001-nist-ai-rmf) for certification and an audit trail. Flexible, early-stage programs lean towards NIST AI RMF for speed. Whichever you pick, [independent evaluation comes first](/the-evaluation-trust-paradox-and-independent-ai-safety-verification), because adopting a framework does not validate the agent itself.\n\n## Conclusion\n\nThe frameworks operate as layers rather than interchangeable options. SR 11-7 gives you the model-risk backbone, re-operationalised around a behaviour-driven risk object. NIST AI RMF or ISO/IEC 42001 provides the governance shell and, in ISO’s case, the audit trail. Independent evaluation precedes both. This comparison is one chapter of the wider AI model risk and rogue agents cluster.\n\nContinuous oversight beats quarterly reviews, because a system that acts and adapts continuously cannot be governed three months at a time.\n\nThe practical test: can you trace what the agent reasoned, which tools it called, and what data it retrieved, continuously? If not, the framework choice is the easy part. The work that keeps you safe is assessing your deployment against these frameworks.\n\n## Frequently Asked Questions\n\n### Is agentic AI exempt from model risk management because of SR 26-2?\n\nNo. SR 26-2 carved generative and agentic AI out of model-risk scope because it is “novel and rapidly evolving”, but that does not mean it is ungoverned. The carve-out removes a regulatory default, not the risk itself. It shifts responsibility back to each institution to close the gap with a behaviour-driven governance approach rather than waiting for a framework built for deterministic models.\n\n### Do I still need SR 11-7 if I adopt NIST AI RMF or ISO/IEC 42001?\n\nYes, but re-operationalised. SR 11-7 supplies the model-risk backbone: sound development, independent validation and ongoing monitoring. NIST AI RMF and ISO/IEC 42001 supply the governance shell and audit trail. Treat them as layers, not alternatives. Keep SR 11-7’s three pillars but redirect them at the decision-and-action path, then choose NIST or ISO for the governance and assurance layer.\n\n### Is NIST AI RMF a certification like ISO/IEC 42001?\n\nNo. NIST AI RMF is a voluntary framework organised around four functions: Govern, Map, Measure and Manage. It offers playbooks and profiles but no certification. ISO/IEC 42001 is a certifiable AI management system with Plan-Do-Check-Act Clauses 4 to 10 and an audit trail. If you need auditable proof, ISO/IEC 42001 is the stronger fit; if you need speed and flexibility, NIST AI RMF is.\n\n### What is goal misalignment in agentic AI?\n\nGoal misalignment is when an agent optimises the wrong objective with complete technical success. The reasoning can be sound and the execution flawless, yet the outcome is harmful because the objective itself was poorly specified. It sits alongside action risk and decision-chain risk as a category that formula-level validation misses, because the error lives in the goal, not in the calculation.\n\n### What counts as a material change for an agentic system?\n\nFor an agentic system, material change goes well beyond code. Prompt edits, tool additions, MCP server changes and LLM provider version updates all count, because any of them can shift behaviour without touching the code repository. Silent third-party updates are the hardest to catch, which is why drift monitoring must trigger on these events rather than only on model retraining or redeployment.\n\n### How do I catch shadow AI?\n\nReplace the static model registry with continuous AI asset discovery. Manual registration misses agents that enter through many doors, from team-level tools to embedded APIs. A living inventory scans for the models, tools and data connections actually in use, so unregistered or shadow systems surface before they cause harm. Discovery then feeds the same validation and monitoring loop as sanctioned systems.\n\n### What is a decision-path trace?\n\nA decision-path trace is the record of what an agent reasoned, which tools it called and what data it retrieved on the way to an action. For agentic AI, this trace is the validation object, replacing the mathematical formula you would validate in a deterministic model. If you cannot reconstruct the path, you cannot independently confirm the behaviour was safe.\n\n### Do I still need a cybersecurity audit if I run an AI risk assessment?\n\nYes. The two are complementary, not interchangeable. A cybersecurity audit confirms the perimeter, configuration and controls exist. An AI risk assessment examines model behaviour, data flows, tool access and non-deterministic outcomes. The audit is point-in-time and control-based; the assessment is continuous and behaviour-based. Agentic AI needs both, because a compliant perimeter does not prove safe agent behaviour.\n\n### What happens when an LLM provider updates the model silently?\n\nThe model you validated in March may not be the model running in June. A silent provider update can change behaviour, tool use and failure modes without any trigger in your code repository or change log. That is why drift monitoring must include LLM provider version changes, and why continuous evals of prompts, tools and model versions are non-negotiable for agentic systems.\n\n### Which framework should a small, early-stage team adopt first?\n\nFor a flexible, early-stage programme, NIST AI RMF is usually the faster start. It is voluntary, organised around Govern, Map, Measure and Manage, and lets you begin without a certification burden. If you are regulated or need an audit trail, ISO/IEC 42001 is the stronger fit. Either way, independent evaluation of the agent comes before the framework choice.\n\n### Can vendor platforms like Arthur.ai and Mindgard replace independent validation?\n\nNo. Arthur.ai and Mindgard describe the operational gap well, covering continuous discovery, decision-path traces and assessment scoping, but their guidance is vendor-sourced, not neutral. Treat them as useful maps, not independent assurance. Independent evaluation of the agent itself still comes first, and adopting a vendor platform does not substitute for validating the behaviour.", "url": "https://wpnews.pro/news/model-risk-governance-for-agentic-ai-sr-11-7-nist-and-iso-compared", "canonical_source": "https://www.softwareseni.com/model-risk-governance-for-agentic-ai-sr-11-7-nist-and-iso-compared/", "published_at": "2026-08-16 16:00:00+00:00", "updated_at": "2026-08-17 02:42:19.914354+00:00", "lang": "en", "topics": ["ai-policy", "ai-safety", "ai-ethics", "ai-agents"], "entities": ["Federal Reserve", "SR 11-7", "NIST AI RMF", "ISO/IEC 42001", "SR 26-2", "OSFI", "Model Context Protocol"], "alternates": {"html": "https://wpnews.pro/news/model-risk-governance-for-agentic-ai-sr-11-7-nist-and-iso-compared", "markdown": "https://wpnews.pro/news/model-risk-governance-for-agentic-ai-sr-11-7-nist-and-iso-compared.md", "text": "https://wpnews.pro/news/model-risk-governance-for-agentic-ai-sr-11-7-nist-and-iso-compared.txt", "jsonld": "https://wpnews.pro/news/model-risk-governance-for-agentic-ai-sr-11-7-nist-and-iso-compared.jsonld"}}