Governing agentic AI under the EU AI Act.
For the institutions running KYC-AML triage, agentic credit scoring, and bank-to-bank A2A workflows.
Test the agents that already read SWIFT free-text, adjudicate loans, and reconcile correspondent-bank confirmations. Produce evidence that a model-risk validator, a regulator, or a CRO can read without translation.
The deadline is 2 August 2026.
High-risk AI obligations are about to bind credit scoring.
EU AI Act Article 26 obligations for high-risk AI systems — including credit scoring, creditworthiness assessment, and risk pricing for life and health insurance — apply from 2 August 2026. SR 11-7, NYDFS Part 500, MAS FEAT, APRA CPS 230, and HKMA's 2024 generative-AI guidance are converging on the same demand: evidence that agentic systems have been tested adversarially and are monitored continuously.
Three classes of agent, all of them T1 or T2.
AgentGuardian classifies targets by what they touch. T1 systems touch tools, memory, and PII at the same time — the dominant pattern for financial-services agents. T2 systems touch tools and memory across a trust boundary, which is how interbank A2A workflows behave by default.
Three steps from production agent to regulator-ready evidence.
The same adversarial-swarm framework you would run in CI is the one that produces the artefacts a model risk validator, an internal auditor, or a supervisor will accept. No second pipeline for compliance.
Fingerprint the agent and shard the corpus
AgentGuardian's recon stage classifies the target as T1 through T4 based on whether it touches tools, memory, and PII simultaneously. KYC-AML triage agents and credit-decision copilots almost always land at T1. The 96-probe corpus is then sharded across ASI01-ASI10 and weighted to the tier.
- T1 classification with documented evidence trail
- 96 probes sharded across 10 OWASP ASI 2026 categories
- Adapter selected — langgraph, crewai, openai-agents, autogen, adk, strands, http
Run the 14-specialist swarm against the production-shaped target
Ten ASI specialists and four OWASP-LLM specialists execute concurrently under a single TaskGroup, sharing a VectorMemory so that an ASI01 prompt-injection finding feeds an ASI02 tool-misuse multi-hop attack. The deterministic mutator engine — oversize, control-chars, truncate, type-confusion, encoding — fuzzes payloads against parsers and policy filters.
- Indirect prompt injection probed through SWIFT free-text, adverse-media RAG, and MCP tool descriptions
- A2A signed-message replay, supervisor impersonation, protocol downgrade
- Goal-drift probes targeting fraud-detection thresholds over long horizons
Emit a signed evidence pack mapped to bank-grade controls
Every finding carries an OWASP ASI 2026 tag, a MITRE ATLAS v5.4.0 technique ID, and a CSA Agentic Red Teaming category. AIVSS produces a deterministic 0-100 score from a published formula. The bundle ships as SARIF 2.1.0, PDF, HTML, JSON, and an evidence directory — the artefacts CROs, model-risk validators, and external auditors actually accept.
- SARIF 2.1.0 ingestible by GitHub Advanced Security and Defender for Cloud
- PDF and HTML reports drafted for SR 11-7 model documentation and EU AI Act Article 13 transparency
- Deterministic AIVSS score for CI gating and board-level posture reporting
Six probes the swarm will run before deployment.
A representative slice from the 96-probe corpus, weighted to the surface area a bank actually exposes. Every probe is tagged with OWASP ASI 2026, MITRE ATLAS v5.4.0, and CSA Agentic Red Teaming categories, and contributes to a deterministic AIVSS score.
Every probe carries OWASP ASI 2026, MITRE ATLAS v5.4.0, and CSA Agentic-RT tags. None of them require an LLM key in stub mode.
Artefacts a model-risk validator actually accepts.
One scan produces five artefacts — report.html, report.pdf, report.sarif (SARIF 2.1.0), report.json, and an evidence/ directory. Below is how those artefacts map to SR 11-7, EU AI Act, NYDFS Part 500, and MAS FEAT obligations without re-running the test or hand-authoring documentation.
The board pack writes itself.
The narrative below is the language operators inside risk, compliance, and finance functions tend to draft from a single AgentGuardian posture report. It is not a customer quote — it is the shape of the conversation the artefacts enable.
The KYC-AML triage agent and the loan-adjudication copilot were tested against 96 probes drawn from OWASP ASI 2026 across all ten categories. The deployment is classified T1 — tools, memory, and PII at the same surface — and the AIVSS posture is 71 out of 100 with no critical findings open beyond the remediation SLA.
Three indirect prompt-injection probes via SWIFT MT103 :70 free-text were blocked by the parser revision shipped in the November release. One A2A signed-message replay finding remains open with a documented mitigation plan to land before correspondent-bank go-live.
EU AI Act high-risk obligations bind from 2 August 2026 with a penalty ceiling of EUR 15 million or three percent of global turnover. The agentic credit-scoring stack is in scope. SR 11-7 model documentation, Article 12 logging, Article 13 transparency, and Article 14 human-oversight evidence are produced from the same scan that runs in CI.
Audit prep moves from manual translation of internal artefacts into supervisor language to attaching a signed PDF and SARIF bundle. The marginal cost of an additional scan is the cost of running the swarm — not the cost of re-authoring the evidence.
Make the 2 August 2026 deadline a
documented posture, not an open question.
Request a regulator evidence pack for your highest-risk agent — KYC-AML triage, credit adjudication, or A2A reconciliation — and see what the artefacts look like before you commit to a scan in production.