Home / Standards & Frameworks
Standards & Frameworks
The standards and frameworks that define AI security in practice: attack taxonomies, control catalogues, threat knowledge bases, agent and MCP risk lists, weight security levels and frontier safety frameworks, with status, structure and how each maps to legal obligations.
| Record | Issued by | Type | Status | Year |
|---|---|---|---|---|
| OWASP Top 10 for LLM Applications 2026The third edition of the reference list for LLM application risk, the first to be informed by real incident data, which promoted Excessive Agency… | OWASP | Security guidance | Published | 2026 |
| Frontier AI safety frameworksThe developer-published frameworks that define when a model's capabilities trigger stronger safeguards, now referenced by California, New York and… | Frontier Model Forum | Developer safety framework | Published | 2026 |
| CEN/CENELEC JTC 21 harmonised standards for the AI ActThe European standards that will give a presumption of conformity with the AI Act's high-risk requirements, including a dedicated cybersecurity… | CEN/CENELEC JTC 21 | Harmonised standard | Draft | 2026 |
| ISO/IEC 27090The information security committee's forthcoming guidance on AI-specific threats and controls, intended to sit alongside ISO/IEC 27001 and give… | ISO/IEC JTC 1/SC 27 | Security guidance | Draft | 2026 |
| NIST IR 8596 (preliminary draft)NIST's profile that maps Cybersecurity Framework 2.0 outcomes to AI, giving organisations with mature CSF programmes a way to extend them to AI… | US NIST | Control framework | Draft | 2025 |
| OWASP Top 10 for Agentic ApplicationsTen risk categories specific to agents (agent goal hijack, tool misuse, identity and privilege abuse, supply-chain and memory poisoning, cascading… | OWASP | Threat taxonomy | Published | 2025 |
| OWASP Top 10 for Agentic Applications 2026The risk list for systems in which a model acts: goal hijack, tool misuse, identity and privilege abuse, supply chain, code execution, memory… | OWASP | Security guidance | Published | 2025 |
| India AI Governance GuidelinesIndia's governance framework of seven principles applied through existing laws, an AI Governance Group, an AI Safety Institute and incident… | India MeitY | Principles and ethics | Published | 2025 |
| Google DeepMind Frontier Safety FrameworkDeepMind's framework defining critical capability levels for CBRN, cyber, ML R&D and harmful manipulation, with early-warning evaluations,… | Google DeepMind | Developer safety framework | Published | 2025 |
| China AI Safety Governance Framework 2.0China's national framework for AI safety and security governance, revised in 2025 to add graded risk management, agent and embodied AI risks, and… | China TC260 | Security guidance | Published | 2025 |
| ISO/IEC TS 22440 series (Parts 1-3, 2025)Three-part technical specification turning the ISO/IEC TR 5469 analysis into requirements and guidance for using AI in safety-related systems,… | ISO/IEC JTC 1/SC 42 | Technical specification | Published | 2025 |
| OWASP MCP Top 10The protocol-level companion to the agentic list, covering the risks that arise where MCP servers expose tools to agents: poisoned descriptions,… | OWASP | Security guidance | Published | 2025 |
| NIST COSAiSThe project to tailor SP 800-53 Rev 5 controls to AI systems, including the first federal control sets written for single-agent and multi-agent… | US NIST | Control framework | Draft | 2025 |
| OWASP AI Maturity Assessment (AIMA)A maturity model with practices across responsible AI, governance, data, privacy, design, implementation, verification and operations, letting… | OWASP | Assurance and certification criteria | Published | 2025 |
| General-Purpose AI Code of PracticeThe voluntary code that general-purpose model providers sign to demonstrate AI Act compliance, with detailed measures on model documentation,… | EU AI Office | Voluntary code of conduct | Published | 2025 |
| CoSAI Principles for Secure-by-Design Agentic SystemsThree core principles — agents should be human-governed and accountable, meaningfully constrained by least privilege and bounded autonomy, and… | Coalition for Secure AI (CoSAI) | Principles and ethics | Published | 2025 |
| CSA AI Controls Matrix (AICM)A vendor-neutral control catalogue for AI security and governance structured like the Cloud Controls Matrix, with implementation guidance, an… | Cloud Security Alliance | Control framework | Published | 2025 |
| ISO/IEC 42006:2025Sets the competence, impartiality and process requirements for certification bodies auditing ISO/IEC 42001 management systems, supplementing… | ISO/IEC JTC 1/SC 42 | Certification body requirements | Published | 2025 |
| CSA AI Controls MatrixA control framework for AI in cloud and enterprise environments that extends the Cloud Controls Matrix with AI-specific objectives, from model… | Cloud Security Alliance | Control framework | Published | 2025 |
| AI Data Security: Best Practices for Securing Data Used to Train and Operate AI SystemsBest practices for protecting data across the AI lifecycle: provenance tracking, integrity verification, encryption, access controls and defences… | US NSA AI Security Center | Security guidance | Published | 2025 |
| Anthropic Responsible Scaling PolicyThe first published frontier safety policy: capability thresholds (CBRN, autonomous AI R&D, cyber) trigger AI Safety Level (ASL) standards for… | Anthropic | Developer safety framework | Published | 2025 |
| C2PA Content Credentials technical specificationThe open standard for content credentials: signed manifests recording how an image, video or audio file was created or edited, including AI… | Coalition for Content Provenance and Authenticity (C2PA) | Technical specification | Published | 2025 |
| IEEE 3119-2025A procurement process standard for public bodies and others buying AI and automated decision systems: problem definition, vendor evaluation, risk… | IEEE Standards Association | Procurement and contracting guidance | Published | 2025 |
| ISO/IEC 42005:2025Guidance for assessing the effects of an AI system on individuals, groups and society across its lifecycle, including how to scope, document and… | ISO/IEC JTC 1/SC 42 | Impact assessment guidance | Published | 2025 |
| OWASP AI Testing GuideOWASP project developing a comprehensive testing guide for AI systems in the tradition of the Web Security Testing Guide, covering data, model,… | OWASP | Testing and evaluation methodology | Draft | 2025 |
| GB/T 45652-2025National standard on the security of data annotation for generative AI: annotator management, annotation rules, quality verification and security… | China TC260 | Data quality and governance standard | Published | 2025 |
| GB/T 45653-2025National standard setting security requirements for collecting, filtering and managing pre-training and fine-tuning data for generative models,… | China TC260 | Data quality and governance standard | Published | 2025 |
| GB/T 45654-2025The national standard behind China's generative AI security assessments: requirements for training-data source vetting, content filtering, model… | China TC260 | Technical specification | Published | 2025 |
| OpenAI Preparedness FrameworkDefines tracked capability categories (biological and chemical, cybersecurity, AI self-improvement), High and Critical thresholds, safeguards… | OpenAI | Developer safety framework | Published | 2025 |
| Agent2Agent protocol specificationGoogle-originated protocol, now under the Linux Foundation, for agents to discover each other via agent cards, exchange tasks and messages and… | Protocol specification | Published | 2025 | |
| ETSI TS 104 223 V1.1.1The first European standard for baseline AI cybersecurity, derived from the UK's AI Cyber Security Code of Practice, which gives auditable… | ETSI TC SAI | Technical specification | Published | 2025 |
| ETSI TS 104 223 V1.1.1 (2025-04)Thirteen principles and 72 provisions for securing AI systems across design, development, deployment, maintenance and end of life, developed from… | ETSI TC SAI | Technical specification | Published | 2025 |
| ISO/IEC 42005:2025Guidance for assessing the impact of an AI system on individuals, groups and society, which is the mechanism ISO/IEC 42001 uses to decide how much… | ISO/IEC JTC 1/SC 42 | Impact assessment guidance | Published | 2025 |
| OpenSSF Model Signing (OMS) specificationDefines how to sign model artefacts and verify their integrity and origin using Sigstore, giving AI supply chains the equivalent of software… | OpenSSF | Technical specification | Published | 2025 |
| AI Guidelines for Business (version 1.1)Japan's unified soft-law guidelines consolidating earlier AI development, utilisation and governance guidelines into common principles and… | Japan METI | Principles and ethics | Published | 2025 |
| NIST AI 100-2 E2025The reference taxonomy of attacks on machine learning, updated in 2025 to cover generative AI: supply chain attacks, direct and indirect prompt… | US NIST | Threat taxonomy | Published | 2025 |
| NIST AI 100-2 E2025 — Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and MitigationsThe reference taxonomy of attacks on predictive and generative AI (evasion, poisoning, privacy, misuse, prompt injection, agent hijacking) and… | US NIST | Threat taxonomy | Published | 2025 |
| GB 45438-2025Mandatory national standard specifying explicit labels and implicit metadata identifiers for AI-generated text, image, audio, video and virtual… | China TC260 | Technical specification | Published | 2025 |
| NIST SP 800-226 — Guidelines for Evaluating Differential Privacy GuaranteesExplains how to evaluate claims of differential privacy, including the privacy pyramid of assumptions, parameter choices and implementation… | US NIST | Testing and evaluation methodology | Published | 2025 |
| EU model contractual AI clauses for public procurement (MCC-AI)Ready-to-use contract clauses that public buyers can attach to AI procurements to pass AI Act obligations (data governance, documentation,… | EU AI Office | Procurement and contracting guidance | Published | 2025 |
| Data Quality Management GuidebookPractical guidance on data quality characteristics, management processes and documentation for AI training and evaluation data, aligned with the… | Japan AI Safety Institute | Data quality and governance standard | Published | 2025 |
| OWASP Agentic AI — Threats and MitigationsA threat-modelling guide for agentic systems with fifteen threat categories, agent architecture patterns and a "playbook" of mitigations, the… | OWASP | Threat modelling methodology | Published | 2025 |
| Hiroshima AI Process Reporting FrameworkA questionnaire and public repository through which advanced-AI developers report annually on risk assessment, incident sharing, security and… | OECD | Transparency and documentation standard | Published | 2025 |
| CSA MAESTROThe threat modelling framework built for agentic AI, which decomposes an agent system into seven layers and models the attacks that emerge within… | Cloud Security Alliance | Threat modelling methodology | Published | 2025 |
| CSA MAESTRO — Agentic AI Threat Modeling FrameworkA layered reference architecture (foundation models, data operations, agent frameworks, deployment, evaluation, security and compliance, agent… | Cloud Security Alliance | Threat modelling methodology | Published | 2025 |
| Meta Frontier AI FrameworkMeta's framework identifying catastrophic outcomes in cyber and CBRN, threat modelling to define capability thresholds, and risk levels (critical,… | Meta | Developer safety framework | Published | 2025 |
| Amazon Frontier Model Safety FrameworkAmazon's frontier safety commitments covering critical capability thresholds in CBRN, offensive cyber and automated AI R&D, evaluation protocols… | Amazon Web Services | Developer safety framework | Published | 2025 |
| Towards a common reporting framework for AI incidentsProposes a common set of reporting criteria (incident description, harms, affected parties, AI system characteristics, causes and responses) so… | OECD | Incident reporting and disclosure | Published | 2025 |