Resources

Field guides and reference material on securing agentic AI in regulated environments. (Reviewed September 2026)

AI governance and risk management

The management-system and risk standards an AI program is built and certified against. Voluntary today, and increasingly the evidence buyers and regulators ask to see.

ISO/IEC 42001:2023, AI management system (Paid). The certifiable management system for AI: how an organization governs, documents and improves what it builds or deploys. Map a program here first.
NIST AI Risk Management Framework (Free). The US voluntary framework built on govern, map, measure and manage. Widely used in healthcare to assess clinical bias, safety and operational risk.
NIST Generative AI Profile, AI 600-1 (Free). The AI RMF companion for generative systems, covering confabulation, data privacy, harmful output and supply chain risk.
ISO/IEC 23894:2023, guidance on AI risk management (Paid). AI-specific risk guidance extending ISO 31000: how to find, size and treat the risks an AI system introduces.
ISO/IEC 42005:2025, AI system impact assessment (Paid). A repeatable process for assessing how an AI system could affect people and society, documented across its lifecycle.
ISO/IEC 5338:2023, AI system life cycle processes (Paid). Extends the general software lifecycle standards with the AI stages they omit, including retraining and drift monitoring.
ISO/IEC 38507:2022, governance implications of AI (Paid). What boards and executives owe in oversight when the organization uses AI, distinct from day-to-day management.
ISO/IEC 42006:2025, audit and certification bodies (Paid). The rules certification bodies follow when auditing against 42001, which is what makes a 42001 certificate mean something.

AI security and secure development

Threat models, controls and secure-lifecycle practice for systems that call tools, hold memory and act on their own. This is the fastest moving part of the field.

OWASP Top 10 for LLM Applications (Free). The most cited AI application security checklist: the ten risks that actually show up in LLM products, each with mitigations.
OWASP Top 10 for Agentic Applications (Free). The agent-specific companion: goal hijacking, tool misuse, memory poisoning and cascading failure across autonomous systems.
OWASP AI Exchange (Free). A continuously updated compendium of AI threats and controls, over 300 pages, feeding into ISO/IEC and EU AI Act work.
OWASP Agentic AI, threats and mitigations (Free). The deeper threat-modeling taxonomy under the agentic top ten, organized by agent design, memory, planning, tool use and deployment.
MITRE ATLAS (Free). An ATT&CK style knowledge base of real attacks on AI systems. The reference for red-teaming a model in production.
NIST SP 800-218A, secure development for generative AI (Free). AI-specific practices layered on the SSDF, covering training data, evaluation and deployment security.
NIST SP 800-218, Secure Software Development Framework (Free). The baseline secure development practices US federal software attestation is written against.
NIST Cybersecurity Framework 2.0 (Free). The six-function structure most security programs organize themselves around, now including govern.
NIST AI 100-2, adversarial machine learning taxonomy (Free). Standard vocabulary for attacks on predictive and generative AI, prompt injection and agent compromise included.
ISO/IEC 27001:2022, information security management (Paid). The certifiable security management system, and the proof point buyers in regulated industries ask for first.
ISO/IEC 27002:2022, information security controls (Paid). The detailed control catalog that implements 27001.
ISO/IEC 27701:2025, privacy information management (Paid). The privacy management system, now standalone and independently certifiable, covering AI-related processing.
NIST SP 800-53 Rev. 5, security and privacy controls (Free). The master US federal control catalog behind FedRAMP and most US compliance regimes.
NIST SP 800-207, zero trust architecture (Free). The access-control model now being applied to agent-to-tool and agent-to-service calls.
CSA AI Controls Matrix (Free). Control objectives for AI systems across 18 domains, mapped to ISO/IEC 42001 and the NIST generative AI profile. Useful for vendor assessment.
OWASP secure development lifecycle guidance (Free). Application security broken into requirements, design, implementation and verification.

Two more are at final draft and worth watching: ISO/IEC 27090 on security threats to AI systems, and ISO/IEC 27091 on AI privacy. Neither is published yet.

Medical device and health software standards

What a medical device or health software product is actually certified against. These are binding through regulation in most markets, not optional.

IEC 62304, medical device software life cycle processes (Paid). The development and maintenance process medical device software must follow, tiered by safety class A, B or C.
ISO 14971:2019, risk management for medical devices (Paid). The risk management standard everything else hangs off, applied across the whole product lifecycle.
ISO 13485:2016, medical devices quality management (Paid). The quality management system manufacturers run, now incorporated by reference into the FDA quality system rule.
IEC 81001-5-1, security in the health software life cycle (Paid). The cybersecurity activities a manufacturer must run across the lifecycle. The security counterpart to IEC 62304.
AAMI TIR34971, applying ISO 14971 to machine learning (Paid). How to run medical device risk management on AI: data, training, opacity and drift. Replaces AAMI CR34971.
ANSI/AAMI SW96:2023, security risk management (Paid). The consensus standard with binding requirements for device security risk management, not guidance only.
ISO/TR 24971:2020, guidance on applying ISO 14971 (Paid). The practical companion to ISO 14971, with worked examples and hazard analysis techniques.
IEC 62366-1, usability engineering for medical devices (Paid). The process for finding and mitigating use error, which for clinical AI is often the dominant risk.
IEC 82304-1, health software product safety (Paid). Product-level safety requirements for standalone health software running on general computing hardware.
AAMI TIR57, medical device security risk management (Paid). FDA-recognized guidance for running security risk management inside the ISO 14971 process.
AAMI TIR97, postmarket security risk management (Paid). Vulnerability monitoring, triage, patching and coordinated disclosure after a device ships.
ISO 14155:2020, clinical investigation of medical devices (Paid). Good clinical practice for designing, running and reporting human clinical investigations.
IEEE 2801-2022, dataset quality for medical AI (Paid). Dataset collection, annotation, storage and retirement, written specifically for medical AI.
IEEE 2802-2022, evaluating AI-based medical devices (Paid). Shared terminology for assessing the performance and safety of AI medical devices.
ISO/TS 82304-2:2021, health and wellness apps (Paid). Quality and reliability criteria for consumer health apps that fall outside formal device regulation.
ISO/IEC/IEEE 12207:2017, software life cycle processes (Paid). The general software lifecycle standard that both IEC 62304 and ISO/IEC 5338 build on.
ISO/IEC/IEEE 15288:2023, system life cycle processes (Paid). The systems-level counterpart, covering hardware, software and people together.

United States: FDA, HIPAA and health IT

What the FDA, HHS and the health IT certification program require of software and AI in US healthcare.

HIPAA Security Rule (Free). The administrative, physical and technical safeguards required for electronic protected health information.
Predetermined Change Control Plans for AI-enabled devices (Free). Final FDA guidance letting a manufacturer pre-authorize planned model changes in one submission instead of refiling for each update.
Good Machine Learning Practice guiding principles (Free). Ten principles from the FDA, Health Canada and the MHRA. The closest thing to a code of practice for medical AI development.
Cybersecurity in medical devices (Free). FDA premarket cybersecurity expectations, covering the software bill of materials, threat modeling and the quality system.
Content of premarket submissions for device software functions (Free). What software documentation an FDA submission must contain, at basic or enhanced level.
AI-enabled device software functions, lifecycle management (Free). Draft FDA guidance on total product lifecycle expectations specific to AI-enabled devices. Not yet final.
Quality Management System Regulation (Free). The FDA rule that replaced the old Quality System Regulation and incorporates ISO 13485 by reference.
AI/ML-based Software as a Medical Device action plan (Free). The original FDA roadmap for adaptive AI, where the predetermined change control idea started.
21 CFR Part 11, electronic records and signatures (Free). The rule behind validated systems, audit trails and electronic signature requirements.
HITRUST CSF (Free to read, paid certification). A control framework harmonizing HIPAA, NIST and others. Frequently demanded of vendors selling into US health systems.
ONC HTI-1 decision support transparency (Free). Certified health IT must disclose source, training data and performance for predictive decision support, so clinicians can judge it.

Europe: the AI Act, MDR and cybersecurity

The European regime stacks. An AI system inside a medical device answers to the AI Act and the MDR at the same time.

EU AI Act, Regulation (EU) 2024/1689 (Free). Risk-tiered rules for AI across the EU. AI in a medical device is high risk, with conformity assessment, technical documentation and human oversight duties. Obligations phase in over several years and the timetable was amended in July 2026, so read the consolidated text for the dates that apply now.
EU Medical Device Regulation 2017/745 (Free). Safety, performance and market access for medical devices in the EU, software included.
MDCG 2025-6, the MDR and the AI Act together (Free). Official guidance on how AI Act duties layer onto MDR and IVDR obligations without doing the work twice.
MDCG 2019-11, qualification and classification of software (Free). How to decide whether software is a medical device and which risk class it lands in. Updated 2025.
GDPR (Free). Health data is special category data under Article 9, and Article 22 limits fully automated decisions with significant effects.
EU In Vitro Diagnostic Regulation 2017/746 (Free). The IVD counterpart to the MDR, covering diagnostic software and AI-based test interpretation.
NIS2 Directive (Free). Cybersecurity risk management and incident reporting duties that reach many healthcare and medical device organizations.
Cyber Resilience Act (Free). Security by design for connected products. Devices already covered by the MDR and IVDR are carved out.
General-Purpose AI Code of Practice (Free). The voluntary route for general purpose model providers to show AI Act compliance on transparency, copyright and safety.

AI quality, transparency and robustness

The vocabulary and measurement standards under the management system. These are what let a claim about an AI system be tested rather than asserted.

ISO/IEC 22989:2022, AI concepts and terminology (Paid). The shared AI vocabulary every other standard in the family builds on.
ISO/IEC 25059:2023, quality model for AI systems (Paid). Adapts the software quality model to AI: probabilistic behavior, data quality, model quality.
ISO/IEC 12792:2025, AI transparency taxonomy (Paid). What to disclose, and to whom, across the AI supply chain. Maps onto the AI Act transparency duties.
ISO/IEC 23053:2022, framework for machine learning systems (Paid). A conceptual map of the components and pipeline stages of a machine learning system.
ISO/IEC TS 4213:2022, classification performance (Paid). How to measure and report machine learning classification performance consistently. Currently under revision.
ISO/IEC 24029-2:2023, robustness by formal methods (Paid). Provable robustness guarantees for neural networks, rather than empirical testing alone.
ISO/IEC TR 24029-1:2021, robustness of neural networks (Paid). The overview of what robustness means for a neural network and how to think about testing it.
ISO/IEC TR 24028:2020, trustworthiness in AI (Paid). A plain overview of what makes an AI system trustworthy and what undermines it.
IEEE 7000-2021, addressing ethical concerns in system design (Paid). A process for treating ethical values as design requirements rather than afterthoughts.

United Kingdom, Canada and Quebec

MHRA Software and AI as a Medical Device Change Programme (Free). The UK roadmap for updating medical device rules for software and AI, covering qualification, classification and post-market duties.
Health Canada pre-market guidance for machine learning-enabled medical devices (Free). Final guidance for licensing machine learning devices in Canada: risk management, data, transparency and predetermined change control.
MHRA AI Airlock (Free). The regulatory sandbox where AI medical device developers test regulatory approaches on real products before a full route to market exists.
Health Canada guidance on Software as a Medical Device (Free). When software counts as a medical device in Canada, and how it is classified.
UK Medical Devices Regulations 2002 (Free). The core UK statutory instrument for medical devices, software included, being amended in stages under the post-Brexit reform program.
Implementation of the future regulation of medical devices (Free). How the UK reform is actually being delivered, through phased secondary legislation rather than one new regulation.
Quebec privacy law, as amended by Law 25 (Free). The strictest privacy regime in Canada: consent, breach notification, privacy impact assessments and a named privacy officer.
PIPEDA (Free). The federal private-sector privacy law setting baseline rules for handling personal information in commercial activity.

Canada has no AI-specific federal statute in force. The Artificial Intelligence and Data Act, carried in Bill C-27, died when Parliament was prorogued in January 2025 and has not been reintroduced, so AI in Canadian healthcare is governed through privacy law and the medical device regulations.

Asia-Pacific

Singapore HSA guidance for software medical devices (Free). Lifecycle guidance covering classification, registration, change management and post-market obligations, including AI-enabled software.
Japan PMDA, IDATEN and two-step approval (Free). The framework that lets a manufacturer pre-agree a change plan so adaptive AI software can update without a fresh approval each time.
South Korea MFDS guidance on AI medical devices (Free). Review and approval criteria for machine learning devices: intended use, algorithm and data documentation, and clinical performance evidence.
Australia TGA, software and AI (Free). Regulation is triggered by a product intended purpose rather than the presence of AI, with premarket assessment and ARTG inclusion.
China NMPA laws and regulations (Free). The official English portal for Chinese medical device regulation, including registration and AI review requirements.
Singapore AI in Healthcare Guidelines (Free). Joint guidance defining what AI developers, deployers and clinicians each owe on data governance, transparency and risk.
Japan PMD Act (Free). The statute behind approval, manufacture and sale of medical devices and medical software in Japan.

International harmonization

Where national regulators converge. Worth reading when a product ships into several markets, because these documents are what the national rules are increasingly written from.

IMDRF Good Machine Learning Practice guiding principles (Free). The ten GMLP principles, now an international consensus document rather than a three-regulator statement.
IMDRF SaMD risk categorization framework (Free). The harmonized method for categorizing software risk by healthcare significance, underneath most national risk tiers.
IMDRF SaMD quality management system (Free). How software engineering practice maps onto medical device quality management for software-only products.
WHO guidance on large multi-modal models in health (Free). Recommendations for deploying generative and multimodal AI across diagnosis, clinical care, education and research.
WHO ethics and governance of AI for health (Free). Six consensus principles for AI in health, covering accountability, safety and equity.