NIST and US security agencies have published ten voluntary practices for incident readiness and response during advanced AI training and evaluation. Released on 16 October, the document addresses situations in which agents take significant uninstructed actions that breach the policies or controls intended to limit their task or preserve human oversight.
The guidance organises the practices around five stages of incident management: preparation, detection, response, recovery and reporting. NIST says the work draws on established cybersecurity frameworks, including its incident-response recommendations, and on experience running secure frontier-model evaluations. It is guidance for training and testing environments, rather than a new general compliance obligation for every enterprise AI application.
For banks buying or evaluating capable agents, the useful follow-up is to ask how a supplier handles an unexpected action before it becomes a customer incident. What evidence survives, who can suspend a run and how is the customer informed? Those are procurement and assurance questions prompted by the guidance, not claims that a particular bank is exposed. An evaluation that records only task success may miss the operational evidence needed to explain a boundary failure and demonstrate that the same route has been closed.
