Published: October 25, 2026
Week 9 was about AI governance implementation: turning principles into rules an organization can enforce. In my Week 9 assignment, I proposed a governance framework built on the NIST AI Risk Management Framework, the GDPR, and the CCPA. In Lab 9.2, I drafted a governance policy for an AI threat detection tool and compared NIST SP 800-53 with the GDPR. That raised a question: where are the AI controls in 800-53?
The Source
NIST’s concept paper SP 800-53 Control Overlays for Securing AI Systems (COSAiS), released August 14, 2025, answers it. Instead of writing a new standard, NIST proposes overlays that tailor existing 800-53 controls to AI across five use cases: generative AI assistants, predictive AI, single-agent systems, multi-agent systems, and AI developers. NIST released an annotated outline for the predictive AI overlay in January 2026.
Analysis
Controls like access control and system integrity already apply to AI, but they were written for traditional software and do not directly address training data integrity or how much authority an AI agent should have. COSAiS keeps the familiar structure that security teams already know how to audit and adds AI-specific guidance. In my framework, the AI RMF defined what to govern and the regulations defined what we owe affected people. Overlays answer the last question: which control proves the policy works?
My Takeaway
A policy requiring human review of high-impact AI decisions is only paper until an access control limits the tool and an audit log shows the review happened. This week showed me that governance needs controls someone can actually check.
References
National Institute of Standards and Technology. (2025, August 14). NIST SP 800-53 control overlays for securing AI systems: Concept paper. https://csrc.nist.gov/csrc/media/Projects/cosais/documents/NIST-Overlays-SecuringAI-concept-paper.pdf
National Institute of Standards and Technology. (2026, January 8). Control overlays for securing AI systems: Using and fine-tuning predictive AI [Annotated outline]. https://csrc.nist.gov/csrc/media/Projects/cosais/documents/COSAiS-Predictive-AI-annotated-outline-Jan2026.pdf
AI use disclosure
Claude (Anthropic) was used at Level 3, AI Collaboration, to assist with source discovery, organization, drafting, and revision. The assignment and lab connections are based on my own Week 9 work. I reviewed the sources, verified the factual information, and approved the final entry.
Leave a Reply