Key takeaways
- The four frameworks differ in force: NIST AI RMF is voluntary, ISO/IEC 42001 is a management-system standard, the EU AI Act is law and OSFI E-23 is a supervisory guideline.
- The EU AI Act's stand-alone high-risk obligations now apply from 2 December 2027, and AI in Annex I products from 2 August 2028.
- Proof-bound transactions give independently verifiable evidence of what an agent paid, to whom and under which authorization.
- Accountability, risk classification, model validation, decision logging and policy scope remain controls your organization owns.
What is an AI governance framework for AI agents?
An AI governance framework for AI agents is the set of roles, risk assessments, controls and records an organization uses to deploy agents responsibly. When agents can move money, the framework must also cover spending authority and the payment record.
Four common reference points for risk and compliance teams are the NIST AI Risk Management Framework, ISO/IEC 42001, the EU AI Act and, for Canadian financial institutions, OSFI Guideline E-23. They differ in legal force, but each asks for evidence that can be traced and reviewed.
TODAQ Press argues that evidence has to start at the payment: "The record of what happened needs to be bound to the transaction at the moment of execution, before any language model generates a summary of it" (You Cannot Audit a Probability). The essays also report that an IMF Policy Note (Davidovic and Tourpe, April 2026) proposes separating probabilistic AI decisions from deterministic payment execution.
How do the four frameworks compare?
Start with what each instrument is and when it applies.
| Framework | Type | Applies to | Key dates |
|---|---|---|---|
| NIST AI RMF 1.0 | Voluntary framework | Organizations that choose to adopt it | Released January 2023 |
| ISO/IEC 42001:2023 | Management-system standard | Any organization providing or using AI-based products or services | Published 18 December 2023 |
| EU AI Act, Article 12 and Article 19 | Regulation | High-risk AI systems | Annex III: 2 December 2027; Annex I products: 2 August 2028 |
| OSFI Guideline E-23 | Supervisory guideline | Federally regulated financial institutions in Canada | Final letter September 2025; effective 1 May 2027 |
Then map what each AI governance framework for AI agents asks for to the evidence proof-bound transactions provide, and to the controls that stay with you.
| Framework ask | Evidence proof-bound transactions provide | Controls you still own |
|---|---|---|
| NIST Govern: accountability and transparency | Who paid, what was paid and under which authorization, verifiable by any party | Named owners, mandates, policies |
| NIST Map: context and impact | A per-agent record of where money moved | Agent inventory, use-case and impact assessment |
| NIST Measure: valid and reliable | An exact record of financial outcomes to measure against | Testing, evaluation, accuracy metrics |
| NIST Manage: respond to risk | Budget transfers and approved purchases, each with a transaction id and receipt | Incident response, limits, kill decisions |
| ISO/IEC 42001: operate and improve an AI management system | Records an auditor can verify without your systems | Scope, objectives, internal audit, management review |
| EU AI Act Art. 12: automatic event logs over the system's lifetime | Payment events recorded at execution, which cannot be altered without detection | Logs of inputs, outputs and operation beyond payments |
| EU AI Act Art. 19 and 26(6): keep logs at least six months | Exportable .toda files that verify offline, plus CSV ledgers | Retention schedule and storage |
| OSFI E-23: model risk management, vendor documentation | Published protocol specifications and proofs for the payment layer | Model inventory, validation and monitoring |
How does NIST AI RMF apply to agentic AI?
NIST AI RMF 1.0 is voluntary. It organizes AI risk work into four functions, Govern, Map, Measure and Manage, and lists trustworthy-AI characteristics that include "accountable and transparent", "valid and reliable" and "secure and resilient".
Under NIST AI RMF, agentic AI fits the same four functions as any other AI system. Applied to agents that pay, the payment record speaks most directly to accountability and transparency. A proof-bound transaction shows what an agent executed, paid and settled, and by whom, without anyone trusting your logs. Security and resilience come from controls around it: a separate agent wallet with its own budget (A3, A8), approval above a set limit (A14) and revocable keys (B29).
Validity and reliability stay with you. A payment record cannot show the agent chose well.
TODAQ Press, drawing on IBM's AGENTSAFE paper, argues that frameworks such as the EU AI Act and NIST AI RMF "address AI risk primarily through pre-deployment certification" (Built Before It Was Named). In fairness, NIST's Manage function and the AI Act's lifetime logging both reach into operation. The practical point stands: runtime evidence must come from somewhere, and the payment is one place it can be bound.
What does ISO 42001 mean for AI agents?
ISO/IEC 42001:2023 sets requirements for establishing, implementing, maintaining and continually improving an AI management system. It applies to any organization providing or using AI-based products or services.
For ISO 42001, AI agents raise a scoping question first: do agent payments sit inside your management system? If they do, the records feeding internal audit and management review should be ones an auditor can check independently. Qatom transactions carry proof that travels inside the file, so a reviewer can verify integrity locally and offline (C8). The wallet ledger exports as CSV (C9).
The rest of the management system, such as setting objectives, treating risk and improving over time, is organizational work that no payment layer performs.
What does the EU AI Act require of AI agents?
Article 12 says: "High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system." The purpose is traceability, risk identification, post-market monitoring and monitoring of operation.
Article 19 covers retention by providers and Article 26(6) covers deployers. Automatically generated logs under their control are kept for a period appropriate to the intended purpose, at least six months unless other law provides otherwise. Providers that are financial institutions keep them as part of their documentation under financial services law.
The dates have moved. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026. It moved stand-alone (Annex III) high-risk obligations, including credit assessment, from 2 August 2026 to 2 December 2027, and AI in products under Annex I to 2 August 2028 (Legal 500). Older material, including some TODAQ Press essays, still gives 2 August 2026.
On the EU AI Act, AI agents raise two cautions. Whether an agent is high-risk depends on its use, so confirm with your counsel how your systems are classified and what you must log. And payment events are one strand of an event log; prompts, inputs, outputs and operation need their own records.
TODAQ Press argues why the payment strand matters in a dispute: "A log generated by the system that acted answers nothing when that system’s account of itself is precisely what is in dispute" (When The Transaction Becomes The Record).
How does OSFI E-23 apply to AI models?
OSFI Guideline E-23 sets model risk management expectations for federally regulated financial institutions. The final guideline letter came in September 2025 and takes effect on 1 May 2027. It explicitly covers AI and machine-learning models, is risk-based and proportional, expects vendors to supply adequate documentation, and expects third-party models to be validated and monitored commensurate with risk.
Under OSFI E-23, AI models that drive agents can fall in scope, and their validation is yours. The payment layer can support monitoring with a verifiable record of each financial outcome. For vendor documentation, the technology behind Qatom is published: the Rigging Specifications, the formal double-spend proof in Simple Rigs Hold Fast and an open-source JavaScript implementation. Qatom deploys hosted, in a VPC, on-premises or air-gapped. Banks should also read agentic payments for banks.
What does the proof show, and what does it not?
Qatom transactions carry cryptographic proof bound to the transaction and its settlement at execution. Settlement and the verifiable record are one operation, and the history cannot be retroactively altered, selectively reconstructed or institutionally withheld, as TODAQ Press describes it.
| Proves | Does not prove |
|---|---|
| What was executed, paid and settled | That the agent's decision was correct |
| Who paid, and under which authorization | That the agent stayed within its intended policy scope |
| That no conflicting version of the history was produced | That the original data or judgment was accurate |
| That the history was not altered or substituted | A system-wide view for macro-prudential monitoring |
| That any party can verify it offline, without trusting the originator | That regulators have formally opined on such records |
TODAQ Press is candid on the last row: "Teaching a supervisor to trust a rigging tree is a heavy lift" (The Agentic Economy's Missing Middle). Visibility is by consent: a regulator or auditor can be given the full record while others see nothing.
Which controls does your organization still own?
Build an AI governance framework for AI agents in this order. Each step maps to at least one framework above.
- Inventory agents and classify each use. Note which ones pay, and whether any could be high-risk under the EU AI Act (NIST Map).
- Name an accountable owner per agent. The Bank of England's Bank Underground blog, as reported by TODAQ Press in The Invisible Shelf, says legal responsibility for an agent's actions remains with the human deployer.
- Set spending authority. Budgets, approval thresholds and approved sellers; see agentic payments risk controls.
- Log decisions, not only payments. Keep inputs, outputs and reasoning records alongside the payment proof; see the AI agent audit trail guide.
- Validate and monitor models. Size the effort to risk, as OSFI E-23 expects, and map it to NIST Measure.
- Set retention. At least six months where Article 19 or Article 26(6) applies, unless other law says otherwise.
- Plan access for auditors and supervisors. Decide which records you export and to whom.
- Review and improve. Feed findings back into the management system, which ISO/IEC 42001 expects to be continually improved.
Further reading
- TODAQ Press, When The Transaction Becomes The Record (20 May 2026)
- TODAQ Press, You Cannot Audit a Probability: The Agentic AI Trust Wall (12 May 2026)
- TODAQ Press, Built Before It Was Named (15 Mar 2026)
- Rigging Specifications and Simple Rigs Hold Fast
Next steps
- Read the overview for risk, compliance and governance teams: Qatom assurance.
- See the records and verification in your own environment: book an enterprise demo.
- Turn the framework into controls with the agentic payments risk controls checklist.