Forrester operationalizes the Five Eyes' agentic AI guidance — governance now has a shape

verified

Monday, May 18, 2026

The News

On May 1, 2026, six national cybersecurity agencies — CISA, the NSA, Australia's ASD ACSC, and their counterparts in Canada, New Zealand, and the UK — published "Careful adoption of agentic AI services." This joint guidance is the first coordinated multigovernment security guidance specifically targeting agentic AI systems, and it carries the full weight of the Five Eyes cybersecurity agencies behind it. The guidance maps almost point for point to the six domains of Forrester's Agentic AI Enterprise Guardrails For Information Security (AEGIS) framework, with controls mapped to NIST AI RMF, ISO 42001, the EU AI Act, and MITRE ATLAS. The agencies warn the technology will likely misbehave and amplifies organizations' existing frailties, recommending slow and careful adoption. (Forrester · The Register)

The Read

The Forrester operationalization is the news here, not the May 1 document itself. A government guidance with no industry crosswalk is a PDF; one mapped to NIST AI RMF, ISO 42001, the EU AI Act, and MITRE ATLAS simultaneously becomes a procurement checklist by Q3. That timing matters because it intersects with the proactive-assistant agents Google previews tomorrow and the cross-app, cross-credential designs every Frontier-tier vendor is shipping — the products being built right now are the ones the framework will be used to reject six months from now. The document contains 23 different risks and over 100 individual best practices to address them ; the practical translation is that your next AI vendor RFP just got 100 questions longer.

Do This Week

Before your next agentic AI vendor demo, send the vendor the six AEGIS domains and ask them to map their product controls to each. The pause is the answer. Vendors that already have the mapping have done the work; vendors that ask what AEGIS is will need to do it on your timeline at your expense — make that visible in the evaluation memo, not after contract signing.

For Legal ops and procurement