On February 17, 2026, NIST’s Center for AI Standards and Innovation announced an AI Agent Standards Initiative, with the Information Technology Laboratory and other federal partners, including the National Science Foundation. The announcement is plain about the constraint. Agents can work for hours, write and debug code, manage calendars, and shop. Their usefulness still depends on reaching external systems and internal data. Without confidence in reliability, and without interoperability, NIST says adopters get a fragmented stack.
The initiative has three pillars: industry-led standards and U.S. participation in international standards bodies; community-maintained open protocols; and research on agent security and identity. NIST paired the launch with a request for information on agent security, due March 9, 2026, and a concept paper on agent identity and authorization, with comments due April 2, 2026. Listening sessions on sector barriers were to begin in April. This is a standards program with a clock, not a product release. Enterprises do not have to wait for the final document to notice what NIST put in the title: identity.
Finance is deploying agents with the autonomy dial down
The Bank of England and FCA 2026 survey shows how a regulated industry is actually switching agents on. Eighty percent of respondents reported agents deployed, and another 14 percent planned to deploy within 12 months. Eighty percent reported agents in production that provide decision support: the agent recommends, a person decides and executes. Only 2 percent reported agents with broad autonomy. Current use for automated customer communications was 16 percent, rising to 34 percent with plans included. Even with plans, no more than 9 percent of respondents expected agents to approve or decline customer outcomes, execute trades, initiate or block payments, or change limits and controls.
That pattern is an identity choice whether or not the firm uses the word. A recommend-only agent can run under a person’s credentials and a person’s click. An agent that pays, trades, or changes a limit needs its own authority, its own log, and a way to turn it off. The survey says almost nobody has granted the second kind of authority. The NIST initiative exists because vendors will ask for it anyway.
Incidents are rising while safety reporting stays patchy
Stanford’s 2026 AI Index puts a measurement warning next to the capability story. Documented AI incidents rose to 362, from 233 in 2024. Leading developers generally report capability benchmarks. Reporting on responsible-AI benchmarks remains spotty. The Index also notes research finding that improving one responsible-AI dimension, such as safety, can degrade another, such as accuracy. An agent standard that only celebrates task success will miss the incident curve the Index is already counting.
Europe is building a parallel test capacity. The Commission’s AI Act page describes a July 2026 action plan on cybersecurity and AI. With ENISA, the Commission plans a blueprint for secure access to advanced models for cybersecurity work, and a testing platform for critical sectors — energy, transport, health, finance, and public administration. A call to expand EU evaluation capacity is meant to be operational in 2027. Identity research at NIST and sector testing in the EU are the same enterprise problem from two capitals: before an agent acts on a live system, someone has to be able to name it, limit it, and watch it.
The purchasing rule that follows is short. Do not bind an agent to a shared human password. Give it a principal you can revoke. Log the actions at the same grain you would demand of a contractor. Keep broad autonomy off until the 2 percent case in the UK survey has a runbook you would actually use at 2 a.m. Standards bodies are writing that down. The firms in the survey have mostly, so far, refused to need it. That refusal is the control. It should be a choice, not an accident of last quarter’s deployment.