AI Governance Posture Analyzer v2.6

Making Brilliant Choices™
2026 Regulatory Edition
Book a Consultation →

🆕 What's New in v2.6 — May 25, 2026 Intelligence Update

  • [Regulatory] EU AI Act Omnibus — confirmed deferral dates: May 7 political agreement confirms Annex III standalone high-risk obligations deferred to December 2, 2027; Annex I product-embedded high-risk (medical devices, machinery, vehicles) deferred to August 2, 2028. Formal adoption still pending — continue planning against Aug 2, 2026 until formally enacted.
  • [Regulatory] Connecticut SB 5 — effective date confirmed October 1, 2026: Governor Lamont announced intent to sign. Confirmed staggered effective date begins Oct 1, 2026. Covers frontier models, chatbots, automated employment-decision tools (AEDT), AI companions, and synthetic media transparency. Begin compliance gap analysis now.
  • [Threat Intel] vLLM CVE-2026-22778 (CVSS 9.8) — Critical RCE via malicious video URL: Unauthenticated attackers can take over vLLM inference servers by sending a crafted video URL to the API, chaining info-disclosure with a heap buffer overflow. Any internet-reachable vLLM multimodal deployment is at risk. Patch to v0.14.1 immediately.
  • [Threat Intel] vLLM CVE-2026-27893 (CVSS 8.8) — RCE via trust_remote_code bypass: Malicious model repositories can execute arbitrary code on inference servers in vLLM v0.10.1–0.17.x by bypassing the user's security opt-out. Upgrade to v0.18.0. Critical supply-chain warning for teams loading models from public registries.
  • [Threat Intel] Hermes Agent persistent prompt injection via DESCRIPTION.md: Skill/plugin DESCRIPTION.md files ingested during agent initialization are an unscanned injection surface. Malicious instructions persist across sessions and alter agent behavior at registration time. Validate all metadata files in skill directories before deployment.
▸ v2.5 release notes (May 25, 2026)
  • [Regulatory] Colorado SB 26-189 SIGNED by Gov. Polis (May 14, 2026).
  • [Framework] NSA AISC CSI — MCP Security Design Considerations (May 20, 2026).
  • [Framework] AWS AI Security Framework (May 2026).
  • [Framework] CISA/NSA/Five Eyes Joint Agentic AI Guidance (May 1, 2026).
  • [Threat Intel] MCP Tool Poisoning confirmed — 19/24 tested configurations altered.
▸ v2.4 release notes (May 18, 2026)
  • [Regulatory] Colorado SB 26-189 passed legislature (May 9).
  • [Regulatory] EU AI Act — Dec 2, 2026 AI-content watermarking deadline confirmed.
  • [Regulatory] Connecticut SB 5 — governor signing expected.
  • [Framework] KPMG/INSEAD AI Board Governance Principles (April 14, 2026).
  • [Framework] US Treasury Financial Services AI RMF (February 2026).
  • [Threat Intel] Ollama GGUF Memory Leak — Critical Data Exposure (May 2026).
  • [Threat Intel] AI-assisted zero-day 2FA bypass exploited in the wild (May 2026).
▸ v2.3 release notes (May 11, 2026)
  • [Threat Intel] CVE-2026-26030 — Microsoft Semantic Kernel RCE (May 7, 2026): Prompt injection escalates to host-level RCE — a single malicious prompt can launch arbitrary processes on the agent host. Patch immediately; treat all agent frameworks as RCE-reachable attack surfaces.
  • [Threat Intel] EU AI Act Council + Parliament Simplification Agreement (May 7, 2026): AI regulatory sandbox deadline shifted to Aug 2, 2027; transparency grace period compressed to 3 months; Aug 2, 2026 high-risk enforcement remains in force.
  • [Framework] NSA/DoD Advisory — "Careful Adoption of Agentic AI Services" (April 30, 2026): First-of-kind DoD/NSA guidance on agentic AI security: supply-chain vetting, least-privilege, memory poisoning defenses, kill-switch requirements.
  • [Regulatory] Maryland HB 895 (Algorithmic Pricing) signed: First US state law targeting AI-driven algorithmic pricing coordination across commerce, housing, and services.
  • [Regulatory] Tennessee SB 837 — AI excluded from legal "person" definition.
  • [Regulatory] Washington & Utah chatbot/provenance bills signed. 8+ states now require AI disclosure at consumer interaction.
▸ v2.2 release notes (May 4, 2026)
  • [Threat Intel] Google IPI In-the-Wild Report (April 24, 2026): 10 new indirect prompt injection payloads on open web — financial fraud, data destruction, API key theft. 32% increase in malicious IPI activity Nov 2025–Feb 2026.
  • [Threat Intel] Reasoning Model Autonomous Jailbreaks: Nature Communications — 97.14% jailbreak success rate across model combinations; avg 5–7 iterations.
  • [Threat Intel] Poetry Jailbreak (Single-Shot Bypass): Near-universal single-shot safety bypass via verse-phrased requests; active red-team technique.
  • [Tool] OpenAI to Acquire Promptfoo: Open-source AI red-teaming tool to integrate into OpenAI Frontier enterprise platform.
  • [Regulatory] Tennessee SB 1580, Idaho S 1297, Oregon SB 1546 all signed into law in early 2026. 45 US states now have 1,561+ active AI bills.
▸ v2.1 release notes (May 1, 2026)
  • [Regulatory] Vermont AI Election Media Act signed March 5, 2026; in force.
  • [Regulatory] EU AI Act Digital Omnibus — April 28 trilogue failed; May 13 talks scheduled. Conditional deferral to Dec 2, 2027 tracked; Aug 2, 2026 remains legally binding.
  • [Framework] NIST IR 8596 (Cybersecurity Framework Profile for AI, Feb 2026 preliminary draft) added.
  • [Tool] Microsoft Agent Governance Toolkit v1.0 (April 3, 2026) — open-source, covers all 10 OWASP Agentic risks.
  • [Framework] OWASP Q2 2026 AI Security Landscapes — LLM/GenAI, Agentic AI, and Red Teaming (first-ever).
  • [Threat Intel] Active CVEs: CVE-2026-33626 (LMDeploy SSRF), CVE-2026-42208 (LiteLLM SQLi), CVE-2026-2069 (llama.cpp buffer overflow).
  • [Threat Intel] Sockpuppeting jailbreak — bypasses 11 major LLMs via assistant-prefill API.
▸ v2.0 release notes (April 2026)
  • 3 new views: Regulatory Horizon, Jurisdictional Mapper, Agentic AI Deep Dive
  • 13 domains / 52 controls (expanded from 11 / 44), with new Jurisdictional Compliance & Safe Harbor domain
  • Updated framework set: NIST AI RMF + Agentic Profile (CSA draft), ISO 42001, EU AI Act, OWASP Agentic Top 10, CSA/OWASP MAESTRO, Singapore Agentic AI Framework
  • US state law coverage: Colorado AI Act, Texas TRAIGA, California SB 53, NY RAISE Act, Illinois HR Act, Utah UAIPA
Overall Maturity
—
Complete the assessment to see your score
Controls Scored
0 / 52
Across 13 governance domains
Jurisdictions Selected
0
Configure in Jurisdictional Mapper
Days to EU High-Risk
—
Until Aug 2, 2026 enforcement

Domain Posture (Radar)

Scores across 13 governance domains (0–4 maturity scale)

Domain Breakdown

Illustrative Benchmark Comparison

Important: Benchmarks shown are illustrative estimates derived from published framework adoption surveys and industry analyst reports; they do not represent certified or audited averages. Use them directionally, not as a compliance target. This tool is an assessment aid, not a certification or legal opinion.

Assessment — 13 Domains · 52 Controls

5-level maturity scale

For each control, select the maturity level that best describes your organization today. Hover framework tags for context.

Scale: 0 Not Started · 1 Ad Hoc · 2 Defined · 3 Managed · 4 Optimized

Regulatory Horizon — Upcoming AI Compliance Deadlines

Track key dates across EU, US federal, and US state AI regimes. Countdowns update automatically based on today's date.

Framework Publications & Profiles

New or updated voluntary frameworks to align with for safe-harbor and maturity gains.

Where Does Your Organization Operate?

Select every jurisdiction where you develop, deploy, sell, or serve customers. The mapper will identify applicable AI laws and safe-harbor opportunities.

Applicable Laws & Obligations

Select one or more jurisdictions above to see applicable requirements.

Safe Harbor Opportunities

Frameworks that provide affirmative defenses or presumptions of compliance if substantially adopted.

Singapore-Aligned Agent Autonomy Classification

Singapore IMDA's January 2026 Model AI Governance Framework introduced a 5-tier autonomy taxonomy. Governance burden increases at each level. Click a tier to explore.

Agent Identity Card — Template

A standardized disclosure format for AI agents per Singapore's framework. Adapt per agent in your organization.

◆ Agent Identity Card

Agent Name
[e.g., ClientOps-Agent-v2]
Owner
[Named human accountable party]
Autonomy Tier
[Level 0–4 per Singapore taxonomy]
Authorized Actions
[Enumerated tool scopes, RBAC roles]
Limitations
[What it must not do; hard guardrails]
Escalation Protocol
[When/how to hand off to human]
Data Retention
[Memory, trace, log retention policy]
Incident Contact
[On-call channel, SOC routing]
Review Cadence
[Quarterly / per-change / per-incident]

OWASP Agentic AI Top 10 — Coverage Tracker

Maps to Microsoft's Agent Governance Toolkit and CSA's Agentic NIST Profile (April 2026 draft).

MAESTRO 7-Layer Mapping

CSA/OWASP Multi-Agent Environment, Security, Threat, Risk & Outcome framework. Your agentic controls map by layer.

MAESTRO layers and naming are from the CSA/OWASP community framework; mapping choices in this tool are illustrative and should be validated against the canonical MAESTRO documentation for your deployment.

Export Your Assessment

📄 PDF Report

Browser-native PDF with full scores, radar chart, and applicable laws.

💾 JSON Snapshot

Raw data export for integration with internal governance systems.

🔁 Import Snapshot

Restore a previously exported JSON snapshot.

Assessment History

Historical snapshots stored in browser localStorage. Useful for tracking maturity progress over time.

Reset

Clear all scores and start fresh. This does not remove saved snapshots.