Agents in Production
Lesson 6 of 6Advanced 8 min

Governance and risk in 2026

Regulation is now in force, not on the horizon. Know the frameworks and the dates, and build the evidence as you train.

In this lesson you'll

  • Use NIST's AI RMF to structure risk work
  • Know the EU AI Act milestones around late 2026
  • Keep documentation that answers regulators and customers

Not legal advice

This lesson is an orientation. Whether and how a law applies to your product depends on what it does and where; ask qualified counsel.

The NIST AI Risk Management Framework organises AI risk work into four functions, Govern, Map, Measure and Manage, and is voluntary and sector-agnostic [1]. Its "Measure" function is where evaluations, red-teaming and monitoring from this Academy fit.

EU AI Act: where things stand in November 2026

  • 2 August 2026: the remainder of the Act began to apply, unless specified otherwise.
  • 2 December 2026: providers of systems that generate synthetic audio, image, video or text, placed on the market before 2 August 2026, must have taken the steps to comply with the Article 50(2) marking obligation. New prohibitions on systems generating non-consensual intimate imagery and child sexual abuse material also apply from this date.
  • 2 August 2027: deadline for providers of general-purpose AI models placed on the market before 2 August 2025.
  • 2 December 2027: obligations for high-risk systems listed in Annex III start to apply [2].

Evidence you'll want anyway

  • A datasheet for each training and test dataset [3].
  • A model card per shipped version, with results broken down by condition and group [4].
  • Evaluation and red-team results stored with each version, and production logs.

Key takeaways

  • Use NIST AI RMF's Govern, Map, Measure, Manage as your structure.
  • EU AI Act obligations are phasing in through 2026 and 2027.
  • Datasheets, model cards and stored evaluations are your evidence.

Practise in the dojo

Pick a deployed model version and check you have an evaluation and a red-team result on record for it.

Review your evaluations

Check your understanding

Score 70 or more to complete the lesson. Progress is saved in this browser.

1. What are the four functions of the NIST AI RMF?

Further reading

Sources

Checked against the original sources in November 2026.

  1. [1]National Institute of Standards and Technology (2023). AI Risk Management Framework (AI RMF 1.0). NIST AI 100-1.
  2. [2]Future of Life Institute (2026). EU AI Act implementation timeline (updated 31 August 2026). artificialintelligenceact.eu.
  3. [3]Gebru, T. et al. (2018). Datasheets for Datasets. Communications of the ACM · arXiv:1803.09010.
  4. [4]Mitchell, M. et al. (2019). Model Cards for Model Reporting. FAT* 2019 · arXiv:1810.03993.