Securing agentic AI: the Five Eyes guidance, NIST’s agent standards, and the contract terms that protect companies deploying AI agents.

Agentic AI systems plan and carry out multi-step tasks, call software tools, and act on other systems with limited human intervention. They hold credentials, move data, and take actions that until recently only employees could take. That changes the security problem: an agent that can be manipulated through the content it reads, or that accumulates more access than its task requires, is a new path into the enterprise. Governments have begun to respond. On May 1, 2026, the Cybersecurity and Infrastructure Security Agency (“CISA”) and the National Security Agency (“NSA”), with their counterparts in Australia, Canada, New Zealand and the United Kingdom, published Careful Adoption of Agentic AI Services, the first joint guidance of the Five Eyes agencies devoted to agentic AI.[1] Standards work at the National Institute of Standards and Technology (“NIST”) and in industry is following. In this Legal Update, we summarize the guidance and the standards taking shape, and identify the contract terms companies should negotiate when they buy, build, or deploy agentic AI.

The Five Eyes Guidance

The guidance is directed at government, critical infrastructure and industry organizations, and its message is cautious. Organizations should adopt agentic AI incrementally, beginning with low-risk tasks that do not involve sensitive data or critical systems, and should not grant agents broad or unrestricted access. Each agent should operate under least privilege, with its capabilities and data access inventoried and tightly scoped; agent identities should be verified; and consequential actions should require human approval. Agentic AI should be folded into the organization’s existing security model, including zero-trust architecture and defense in depth, rather than run as an experiment outside it. NSA groups the risks into five categories: privilege, design and configuration, behavior, structural, and accountability. The guidance also lists mature cybersecurity practices that the agencies regard as prerequisites to deploying agents at all.

The guidance is not binding. Its legal significance lies elsewhere. Regulators that enforce “reasonable security” under Section 5 of the FTC Act and state law, and plaintiffs who litigate after an incident, will treat a six-agency consensus on how agents should be deployed as the baseline against which a company’s choices are measured.[2] A company that gave an agent standing access to production systems, or let it act on sensitive data without human review, will be asked why it departed from the guidance.

The Standards Taking Shape

On February 17, 2026, NIST’s Center for AI Standards and Innovation launched the AI Agent Standards Initiative, organized around industry-led standards development, open-source interoperability protocols, and research on agent security and identity.[3] Twelve days earlier, NIST’s National Cybersecurity Center of Excellence had released a concept paper, Accelerating the Adoption of Software and AI Agent Identity and Authorization, proposing to apply existing identity standards, including OAuth 2.0 and the zero-trust and digital-identity guidelines in NIST SP 800-207 and SP 800-63, to AI agents, covering identification, authentication, authorization, delegation, auditing, and prompt-injection controls.[4] In the private sector, the OWASP GenAI Security Project published its Top 10 for Agentic Applications in December 2025, which has become the common vocabulary for agent risk.[5] None of these documents is a binding standard, and NIST’s first formal deliverables are not expected before late 2026. Together, however, they describe what regulators, auditors and courts will soon regard as ordinary care: an identity for every agent, scoped and time-limited authorization, a record of every action, and testing against manipulation.

Contract Terms for Agentic AI

Existing security terms in technology contracts were written for software that does what it is told. Agents act on their own. The following terms address that difference.

• Definitions. Define “agent,” “action,” and “tool,” and define a “security incident” to include an agent action outside its authorized scope, whether caused by an attacker, a prompt injection, or a model error, and not only a breach of data.
• Security standard and evidence. Name the frameworks the vendor must follow (NIST CSF 2.0 and the AI Risk Management Framework, the Five Eyes guidance, the OWASP agentic Top 10) and the evidence of compliance: audit reports whose scope covers the agent, and penetration and red-team testing that includes prompt injection.
• Identity and least privilege. Each agent has its own identity; credentials are scoped to the task and expire; agents never use a human user’s credentials; the vendor maintains an inventory of each agent’s permissions and data access.
• Human approval and a stop. List the actions that require human confirmation (payments, data deletion or transfer, communications to third parties, changes to other systems) and require a mechanism to suspend an agent immediately.
• Logging and audit. Complete, tamper-evident logs of agent actions, retained for an agreed period and available to the customer, with audit rights that extend to the vendor’s model and tool providers.
• Data. No use of customer data to train or improve models without written consent; segregation; data location; disclosure of every subprocessor and model provider, with flow-down of these terms.
• Incident notice. Notice within a fixed period, 24 to 72 hours, of any incident as defined above, with cooperation obligations and cost allocation. For vendors to the Government of Puerto Rico, the 48-hour notice to PRITS and the contracting agency under Ley Núm. 40-2024 sets the outer limit, as discussed in our Legal Update of October 19, 2026.[6]
• Change control. Notice and testing before model, version, or tool changes that alter what the agent can do.
• Liability and insurance. Indemnity for agent actions outside authorized scope and for security breaches, with a negotiated super-cap; cyber and technology errors-and-omissions coverage that does not exclude AI.
• Exit. On termination, revocation of all agent credentials, disabling of agents, and return or deletion of data, confirmed in writing.

Practical Implications for Companies

Companies should consider the following:

• Inventory: Identify every agentic system in use or in procurement, the credentials it holds, and the systems and data it can reach. Most companies will find more than they expect.
• Gate: Decide now which actions an agent may never take without a person, and build the approval step before the agent is deployed.
• Contract: Review existing AI and SaaS agreements against the terms above. Few agreements signed before 2026 define an agent’s unauthorized action as an incident.
• Test: Add prompt injection and agent misuse to tabletop exercises and penetration tests.
• Document: Record the risk assessment and the controls chosen. If an agent causes an incident, that record answers the question of whether the company followed the guidance. Our Legal Update of October 22, 2026 explains why that record must be kept as decisions are made.

We will continue to monitor developments and will provide further updates as warranted. If you have questions about the matters discussed in this Legal Update, please contact the Maceira Zayas lawyers with whom you regularly work.

Endnotes

1. Cybersecurity and Infrastructure Security Agency, National Security Agency, Australian Signals Directorate’s Australian Cyber Security Centre, Canadian Centre for Cyber Security, New Zealand National Cyber Security Centre, and United Kingdom National Cyber Security Centre, Careful Adoption of Agentic AI Services (May 1, 2026).
2. 15 U.S.C. § 45.
3. National Institute of Standards and Technology, Announcing the AI Agent Standards Initiative for Interoperable and Secure AI Agents (Feb. 17, 2026).
4. National Cybersecurity Center of Excellence, Accelerating the Adoption of Software and AI Agent Identity and Authorization (Concept Paper, Feb. 5, 2026).
5. OWASP GenAI Security Project, Top 10 for Agentic Applications 2026 (Dec. 2025).
6. Ley Núm. 40-2024, Art. 7.

This publication provides general information on legal developments of interest to clients and friends of Maceira Zayas. It is not a comprehensive treatment of the subject matter and does not constitute legal advice. Readers should consult counsel before acting on any matter discussed here. Developments after the date of this Legal Update are not reflected.

‍