Rules for AI that tests, United States and the Gulf.
Of the 50 testing regimes The Seam Report 2026 coded, 41 from the United States and the Gulf and 9 international benchmarks, none of the 47 with public text sets rules for AI-driven testing. Guidance on AI agents moved faster. This is what each text asks, and whether it binds. Reviewed October 30, 2026.
The gap.
For The Seam Report 2026 we coded 50 testing regimes as of September 28, 2026: 41 from the United States and the six GCC states, and 9 international benchmarks. None of the 47 with public text sets rules for AI that tests, and the text of the other 3 is not public. Our testing rules reference now carries them with later additions. The texts below govern AI systems in general; they are what a regulator would reach for today.1
- Binding
- A duty on the bodies named.
- Guidance
- Advice or expectations, not enforceable on their own.
- Draft
- Published for consultation, not yet final.
- Accreditation
- A voluntary industry scheme that firms can be assessed against.
- Text not public
- Announced, but the text has not been published.
Gulf states.
Two central banks already ask for a human who can stop an AI system. Saudi Arabia’s NCA has the most detailed draft, including AI-specific penetration testing.
| Date | Text | What it asks | Applies to | Force |
|---|---|---|---|---|
| February 2024 | Guidelines for Secure Adoption and Usage of AINational Cyber Security Agency, Qatar | Human oversight built into AI system design, with checks and rules for escalation. Options to use enterprise data for vendor training should be disabled “wherever possible”.2 | Organizations in Qatar | Guidance |
| September 4, 2024 | Artificial Intelligence GuidelineQatar Central Bank | Prior approval for fully autonomous high-risk AI, guard rails the AI cannot override, a person overseeing high-risk AI who can stop it or close it down, and an attack-surface review before deployment.3 | QCB-licensed entities | Binding |
| September 2024 | Dubai AI Security PolicyDubai Electronic Security Center | Announced in September 2024; the policy text is not public.4 | Not stated in the announcement | Text not public |
| May 20, 2025 | General Policy for the Use of AIInformation & eGovernment Authority, Bahrain | Keeps “the final decision in important matters” under human control.5 | Government entities | Binding |
| July 2025 | Study on agentic AISaudi Data and AI Authority | Least privilege, real-time monitoring, AI red teaming and human oversight of final decisions in sensitive operations.6 | Recommendations | Guidance |
| February 2026 | Guidance note on responsible adoption of AICentral Bank of the UAE | “The clear and immediate ability, with human intervention, to cease use” of any AI system; human-out-of-the-loop AI only for low-risk processes; independent annual review of third-party AI; testing of vendor auto-updates.7 | Licensed financial institutions | Guidance |
| July 2026 | AI Cybersecurity Guidelines, AICG-1:2026 (draft)National Cybersecurity Authority, Saudi Arabia | Classify agent actions by impact and reversibility, graduated autonomy, egress limited to approved paths, AI-specific penetration testing before deployment and periodically, testing such as red teaming, validation of human override, logging of AI-initiated actions, safe shutdown.8 | Any entity in the Kingdom that uses or plans to use AI; the draft says the guidelines are not mandatory | Draft |
For the testing of your own AI systems that the QCB guideline and the NCA draft describe: AI red teaming
United States.
US bank supervisors took generative and agentic AI out of model risk guidance. Federal action centered on coordination and access, not controls.
| Date | Text | What it asks | Applies to | Force |
|---|---|---|---|---|
| April 17, 2026 | Model risk guidance, SR 26-2Federal Reserve, FDIC and OCC | States that generative and agentic AI models “are not within the scope of this guidance”.9 | Banks, mainly over $30 billion in assets | Guidance |
| May 21, 2026 | Frontier AI industry letterNYDFS | Review vulnerability timelines, map dependencies and apply human oversight to AI-generated code. It “does not impose any new requirements”.10 | NYDFS-regulated entities | Guidance |
| June 2, 2026 | Executive Order 14409The White House | An AI cybersecurity clearinghouse and voluntary government access to frontier models before release. Rules out mandatory licensing or preclearance.11 | Federal agencies | Binding |
International and industry.
The most detailed agent controls come from six national agencies and the Financial Stability Board. CREST runs the one accreditation for AI-enabled testing.
| Date | Text | What it asks | Applies to | Force |
|---|---|---|---|---|
| May 1, 2026 | Careful adoption of agentic AI servicesSix national agencies (ASD’s ACSC, CISA, NSA, Canadian Cyber Centre, NCSC-NZ, NCSC-UK) | People, not the agent, decide where approval is needed; human approval for high-impact actions; fail-safe by default; no agent write access to logs; autonomy increased in phases.12 | Organizations adopting agentic AI | Guidance |
| May 22, 2026 | Principles for AI-enabled activitiesCREST | Nine voluntary principles for security providers that use AI, including telling clients about AI use and data handling, keeping competent people in oversight and keeping traceable records. Organizations endorse them by signing the CREST AI Charter.13 | Security providers that choose to endorse them | Guidance |
| July 28, 2026 | AI-Enabled Penetration Testing accreditationCREST | An optional accreditation that assesses responsible use of AI in penetration testing. The first accredited firms were announced on September 3, 2026.14 | Testing providers that apply | Accreditation |
| October 15, 2026 | Sound practices for responsible adoption of AI (final report)Financial Stability Board | Twelve sound practices, “non-prescriptive” and not a binding standard: a kill switch as one form of human oversight, a unique identifier for each agent, risk-based triggers for human approval, deterministic controls that prohibit certain agent actions, monitoring for scope creep, least privilege, and adversarial testing such as ethical red teaming for agents with higher autonomy or risk. On AI in threat-led testing: “further work is needed”. Replaces the June 10, 2026 consultation.15 | Financial institutions | Guidance |
What these rules expect of people, and what automated testing does well: What automation misses
Until a rule exists, a buyer can have a provider checked against the ten controls: AI testing assurance
Sources.
Primary sources unless marked. Each shows the date we last opened it and confirmed what we cite.
- 1 The Seam Report 2026, Bendings, chapter 8 (AI) and chapter 9 (testing rules) Checked October 30, 2026.
- 2
- 3 Artificial Intelligence Guideline, Qatar Central Bank, September 4, 2024 Checked September 28, 2026.
- 4 Dubai Electronic Security Center launches the Dubai AI Security Policy, DESC, September 20, 2024 Checked September 28, 2026.
- 5
- 6 Study on agentic AI (Arabic), Saudi Data and AI Authority, July 2025 Checked September 28, 2026.
- 7
- 8
- 9
- 10 Heightened cybersecurity risks associated with frontier AI models, NYDFS industry letter, May 21, 2026 Checked September 28, 2026.
- 11 Executive Order 14409, Promoting Advanced Artificial Intelligence Innovation and Security, June 2, 2026 Checked September 28, 2026.
- 12
- 13 CREST's principles for AI-enabled activities, CREST, May 22, 2026 Checked September 28, 2026.
- 14 CREST launches new AI accreditation, CREST, July 28, 2026 Checked October 30, 2026.
- 15
Discuss an engagement privately.
Write from your organization’s email address. Tell us what is in scope, your deadline and who can authorize testing. Leave sensitive details out of the first message.