No Audit Catalogue for AI Agents — What Companies Hold On To Instead

“Can we have our AI agent certified?” is the question that comes up most often in conversations about agents — usually not out of caution, but because procurement, a client or the company’s own internal audit wants evidence. The honest answer in October 2026 is: no. A binding audit catalogue for LLM-based agentic AI does not exist.

More interesting than that no is what follows from it. The Bundesamt für Sicherheit in der Informationstechnik (BSI, the German Federal Office for Information Security) has only just put the drafting of exactly such audit requirements out to tender — project PRAKI, bid deadline 21 September 2026, duration 18 months. A missing catalogue does not relieve anyone, though; it shifts the burden. Whoever cannot point to a certificate has to produce their own assessment. That documentation is what counts in a liability case and in front of clients.

At a glance

• What applies: No binding audit catalogue for agentic AI. PRAKI is out to tender (bid deadline 21/09/2026, 18 months duration), the award is not published. At NIST, preparatory work has been under way since February 2026 — with no final standard.
• What follows: What holds up is the OWASP Top 10 for Agentic Applications 2026 — a practitioner reference with no certifying force, but with a usable risk structure.
• The catch: The obligations of the EU AI Act do not hang on the catalogue. Without a certificate, your own dated assessment becomes the evidence — or there is none.

What exists and what does not

Four initiatives come up regularly here. Sorted by binding force, the misunderstanding dissolves:

Two points remain open, and they stay open here as well. The award for PRAKI: reported in several places, but no primary BSI publication on the award decision is available to me — and without a known project start, the duration is not a date but a length of time. The NIST position: initiative and concept paper are process, not result; a final standard does not exist. For the period under review, no relevant ENISA publication on agents could be found.

The gap is not a free pass

The absence of a technical audit catalogue is readily read as though the legal position were not yet in place. It is in place: the obligations of the EU AI Act (KI-Verordnung) attach to a system’s role and intended purpose, not to the existence of a catalogue.

The legislator has even demonstrated how the two levels relate. Regulation (EU) 2026/1744, the so-called Digital Omnibus, entered into force on 27 July 2026 and postponed the high-risk obligations: Annex III to 2 December 2027, Annex I to 2 August 2028. The stated reason was explicitly the delay in the harmonised standards. What was postponed, therefore, were deadlines, not obligations — and what was not postponed applies: the transparency obligations under Art. 50 have been applicable since 2 August 2026.

How concrete the threat picture is alongside that is a different question from the one about the standard — the figures are in my article on the 2026 AI security study by the BSI and the TÜV Association.

A self-assessment framework that holds up

With no catalogue in place, you need a structure of your own — and if you invent it yourself, it is open to attack. The OWASP Top 10 for Agentic Applications 2026 names, among others, Agent Goal Hijacking, Tool Misuse, Identity/Privilege Abuse and Supply Chain. Each of the four yields one audit question and one record entry:

Three of the categories can be backed by dated events. Palo Alto Unit 42 reports, for October 2026, indirect prompt injection against browser agents in the wild (vendor research, the page’s date unclear): an agent that reads web pages also reads instructions placed there for it. For the GitLab AI Gateway, CVE-2026-90970 became known on 2 October 2026 — an escape from the prompt template sandbox via a flow configuration, patched the same day; read via an aggregated overview, not in the advisory itself. And in February 2026 the SANDWORM_MODE campaign distributed 19 npm packages that additionally installed malicious MCP servers and read out configurations of Claude Code, Cursor and Windsurf; ignore-scripts=true blocks those lifecycle hooks.

For Identity/Privilege Abuse I have no cross-verified incident to cite. The category stays in the framework nonetheless: a sentence in the system instruction is not access control.

Three objections that belong here

First: a checklist with no certifying force is not an audit catalogue. OWASP is a community reference, neither accredited nor audited by any body. Working through it gives you a documented approach, not an attestation — worth a great deal, as long as you do not sell it as a certificate.

Second: waiting for PRAKI is not a plan. Award not published, project start unknown, duration a length of time with no starting point. Even a finished result would first be a document containing audit requirements; from there to a certifiable scheme is another step. Agents that check invoices or read client mail today keep running in the meantime.

Third: your own assessment is worth only as much as its record. What is not dated, versioned and traceable cannot be produced in a dispute — the same discipline as in measuring AI quality.

The gap in the row stays a gap. What bridges it is thinner than the rest — and it is the only thing you can produce yourself if it comes to that.

What this means for your business

Separate governance from assessment. Which rules apply, who approves and how far autonomy reaches is set out in my guide to AI agents in the company. This article is about the level below that: the evidence that you have also tested what you laid down. A policy without an assessment record documents an intention, not a result.

Document before the incident, not after it. Anyone answering for an agent’s actions needs the precaution timestamped beforehand — why that is not a formality is set out in agents with computer access.

Make the assessment repeatable. Four categories, four audit questions, four record entries, one date, one version: that fits on two pages and runs again after every model or tool change. Those same two pages are the answer to the certificate question — not the certificate, but more than most can produce.

Conclusion

The position in October 2026 is less comfortable than a certificate and more honest than its promise. There is no audit catalogue for agentic AI; the BSI has put the work out to tender, NIST has preparatory work under way, and what carries in the meantime is a community list with no seal. The absence of the catalogue relieves no one of an obligation — it only removes the option of handing it to a third party.

If you want to know what such an assessment record looks like for your agent, and which of the four categories is the critical one in your case, let’s talk. I assess the obligations as a business lawyer and build the agents myself.

FAQ

Can I have an AI agent certified in October 2026?

No. For LLM-based agentic AI there is no binding audit catalogue. The BSI has only just put the drafting of such audit requirements out to tender as project PRAKI: bid deadline 21 September 2026, duration 18 months, award not published. What you can present today is your own documented assessment, nothing else.

What is the BSI project PRAKI and when will there be a result?

PRAKI is a BSI tender for audit requirements for LLM-based agentic artificial intelligence. What is known: the bid deadline of 21 September 2026 and a duration of 18 months. No date can be named, because the award has not been published — and audit requirements would still not be a certification scheme.

Is the OWASP Top 10 for Agentic Applications 2026 enough as evidence?

Not as a certificate, but very much as a framework. The list is the authoritative practitioner reference for agent risks and names, among others, Agent Goal Hijacking, Tool Misuse, Identity/Privilege Abuse and Supply Chain. It carries no certifying force: working through it gives you no attestation, but documented diligence.

Do obligations fall away as long as there is no audit catalogue?

No. The obligations of the EU AI Act attach to a system’s role and intended purpose, not to the existence of a technical audit catalogue. The Digital Omnibus postponed the high-risk obligations precisely because harmonised standards were delayed — to 2 December 2027 for Annex III and 2 August 2028 for Annex I. What was postponed were deadlines, not obligations.

---

Sources — as of 16/10/2026

• BSI project PRAKI, tender (secondary reports) — https://www.paperclipped.de/de/blog/bsi-ki-agenten-angriffsflaeche-warnung/ · https://it-dock.de/blog/news/bsi-ki-agenten-sicherheit/
• OWASP Top 10 for Agentic Applications 2026 (overview) — https://elevateconsult.com/insights/agentic-ai-security-solutions-owasp-2026-guide/
• NIST, AI Agent Standards Initiative (CAISI) and NCCoE concept paper — https://labs.cloudsecurityalliance.org/research/csa-research-note-nist-ai-agent-standards-initiative-complia/
• Palo Alto Unit 42, indirect prompt injection against browser agents — https://unit42.paloaltonetworks.com/ai-agent-prompt-injection/
• CVE-2026-90970, GitLab AI Gateway (via aggregated overview) — https://github.com/webpro255/awesome-ai-agent-attacks
• npm campaign February 2026 — https://thehackernews.com/2026/02/malicious-npm-packages-harvest-crypto.html · MCP supply chain — https://lorikeetsecurity.com/blog/mcp-supply-chain-attacks-ai-agent-security
• Regulation (EU) 2026/1744 (Digital Omnibus), deadlines — https://www.actuia.com/en/news/ai-act-obligations-in-force-and-delays-under-omnibus-2026-1744/
• Bundesnetzagentur (Federal Network Agency), transparency obligations under Art. 50 — https://www.bundesnetzagentur.de/DE/Fachthemen/Digitales/KI/4_Transparenzpflichten/Leitlinien/start.html

This article is general information and not legal advice in an individual case. As of 16 October 2026; the standardisation position changes quickly — check the current state before making any commitment to clients.