The three open standards do not replace the regulations, standards and specifications you already use. They complement them — each answering a specific question that existing frameworks leave open. This crosswalk shows where each standard sits alongside established work.
The relationships below are provided to aid understanding. They are not a claim of formal equivalence, certification or endorsement by any of the bodies named, and conforming to one standard does not by itself satisfy another. Where a rigorous, clause-level mapping exists, it is linked directly.
F-ACT governs whether an autonomous agent may act. It maps cleanly onto the major AI-governance regimes because it addresses the same question they do — accountable, controllable behaviour — at the level of an individual agent.
F-ACT’s dimensions give an implementer a concrete, testable way to evidence the risk-management, human-oversight and record-keeping obligations the Act places on high-risk and general-purpose AI. Timing note: under the Digital Omnibus, Regulation (EU) 2026/1744, Annex III high-risk obligations now apply from 2 December 2027 and Annex I from 2 August 2028; Article 50 transparency duties have applied since 2 August 2026. Systems already on the market before 2 August 2026 have until 2 December 2026 to meet the Article 50 marking of AI-generated content.
Signed 14 May 2026, it repeals and replaces the Colorado AI Act (SB 24-205) and takes effect on 1 January 2027. Developers must document intended uses, known risks and limits; deployers must give notice before a consequential decision, explain adverse outcomes and offer human review; both keep records for three years. F-ACT records of authority, oversight and evidence are one way to keep that documentation. Enforcement is by the Colorado Attorney General, whose rules are due by 1 January 2027.
The GUARD ladder operationalises the Govern / Map / Measure / Manage functions for a single agent, turning a voluntary framework into per-agent, verifiable conformance claims.
ISO/IEC 42001 certifies an organisation’s AI management system; F-ACT attests an individual agent within it. The two are complementary — organisational assurance above, per-agent assurance below.
F-ACT expresses the OECD principles of accountability, transparency and human control as machine-checkable dimensions rather than aspirational statements.
T-RUE governs revocable, transitive trust — the ability to withdraw an endorsement and have that withdrawal propagate. It complements the established revocation and status mechanisms rather than replacing them.
Classic PKI revokes a certificate at its issuer. T-RUE extends the same instinct to chains of endorsement between agents, where a withdrawal must cascade to everything that relied on it.
Status List gives a credential a revocable status bit. T-RUE builds on that pattern and adds transitivity — revoking upstream trust invalidates the endorsements derived from it.
OpenID Federation establishes trust chains between entities. T-RUE addresses the reverse problem — how those chains are cleanly and provably torn down.
SLSA attests how an artefact was produced; T-RUE governs whether the endorsements attached to a producer are still live at the moment of reliance.
R-EAL governs crowdsourced content credibility — a tiered, revisable credibility credential for a piece of content. It sits alongside provenance standards, adding a credibility judgement on top of a provenance record.
C2PA records how a piece of media was captured and edited. R-EAL is complementary: provenance tells you where content came from, R-EAL tells you how credible the community has found it to be.
R-EAL credibility credentials are expressed in a Verifiable-Credentials-compatible shape, so existing wallets and verifiers can carry and check them.
R-EAL draws on bridging-based approaches to community assessment — surfacing judgements that hold across differing viewpoints, rather than raw majority vote.
Governments and standards bodies have begun publishing guidance specific to AI agents. OCC aims to complement this work, not compete with it. Where a body here already covers a question, we defer to it.
NIST’s work on agent identity and authorisation (including the NCCoE paper on software and AI agent identity) addresses the same per-agent questions F-ACT’s Grant and Usage controls ask. OCC tracks it as the reference point for agent identity.
Its five risk classes — privilege, design and configuration, behavioural, structural and accountability — and its advice on incremental deployment and least privilege align with AIH-12’s graduated delegation and F-ACT’s GUARD controls.
Its failure modes for multi-agent systems — including propagation and contagion — are the problem T-RUE’s transitive revocation and AIH-12’s H6 Networked horizon are designed around.
A threat list rather than a governance standard. Identity and privilege abuse, tool misuse, cascading failures and rogue agents map onto the GUARD controls, T-RUE revocation and PACTE’s Authority and Tactics questions.
Work-in-progress protocol drafts for how agents prove identity and obtain authorisation. F-ACT and T-RUE sit above the protocol layer and are designed to be carried by whatever the IETF settles on.
Reported to consider MCP, OAuth 2.1/OIDC, SPIFFE/SPIRE, SCIM and NGAC for identifying and authorising agents. These are carriers for the Grant and Revocation evidence F-ACT and T-RUE ask for, not substitutes for it.
The FTC Chair has been reported as rejecting an “autonomous actor” defence, placing responsibility on those who build and deploy agents. That raises the value of a provable record of who granted what authority — the question F-ACT’s Grant control and PACTE’s Authority question address.
Connecticut’s AI responsibility and transparency legislation is reported to phase in from October 2026, and an Illinois AI safety measures act from January 2027. OCC instruments do not establish compliance with either; they can supply evidence of oversight and revocability.
Organisational AI management system. OCC instruments operate at the level of an individual deployment inside such a system.
The OWASP GenAI Security Project published its Top 10 for Agentic Applications in December 2025. It is a security taxonomy; OCC is a governance and evidence layer. The table shows which OCC control, record field or protocol gives an operator a place to evidence how each risk is handled. OWASP has not reviewed or endorsed this mapping.
An attacker redirects the agent’s objective or plan, directly or through poisoned documents and tool outputs.
In OCC: The declared mandate (purpose and limits) is the reference the agent is held to. Actions outside it are an Action or Authority failure under the 5 As and an incident under the protocol.
The agent uses legitimate tools in unsafe, unintended or recursive ways.
In OCC: Effective authority lists the tools and permissions the agent actually holds; it is reconciled against declared authority. AIT-12 controls require limits enforced at the tool, not only in the prompt.
Unauthorised action through insecure delegation, ambiguous agent identity or reused human credentials.
In OCC: Every record names the agent identifier, the principal and the accountable person. T-RUE provides a tested revocation route. Delegation chains should be declared (see multi-hop delegation).
A tool, model, schema, plugin or other agent the system trusts at runtime is compromised.
In OCC: Evidence entries can carry SHA-256 digests and attestation levels so the components an assessment relied on can be pinned. Material changes to components re-open the record under the Lifecycle profile.
Agent-generated or agent-triggered code runs without validation, sandboxing or isolation.
In OCC: Code execution is an authority. It belongs in effective authority and raises the AIH-12 horizon; higher thresholds require isolation and human approval for irreversible actions.
Injected or leaked data in persistent memory or context shapes later reasoning and actions.
In OCC: PACTE asks whether the agent’s context is provenance-tracked and whether its integrity can be shown. R-EAL applies to the content an agent ingests and produces.
Messages between agents are spoofed, intercepted or injected for lack of authentication or integrity checks.
In OCC: Connectivity is one of the four questions that set an AIH-12 horizon. Networked agents (H6+) need authenticated peers and a declared delegation chain.
A small fault in one agent or tool propagates through connected systems.
In OCC: Severity S1 covers widespread or hard-to-reverse harm. Incidents record containment time and whether the revocation route worked, which is the evidence that a cascade can be stopped.
People over-rely on agents through misleading explanations, authority framing or persuasive behaviour.
In OCC: The 5 As are written as plain-language questions any person can ask of an agent. The register states, on every record, that a status is not certification, so a listing cannot be used as authority framing.
Agents act beyond their intended scope through goal drift, collusion, reward hacking or runaway autonomy.
In OCC: The authority ceiling caps what the agent may do; a tested revocation endpoint is required on every record; S1 incidents prompt reviewers to consider suspension.
Incidents recorded in the Assurance Portal can be coded with the ASI identifiers above, so an operator’s incident history can be read against the OWASP taxonomy. See the Incident & Disclosure protocol.