# Governance, risk & sovereignty

Author: Murali Sid (https://linkedin.com/in/muralisid)
Source: https://www.agenticarchitectureskills.com/library/layers/r11-governance-risk-sovereignty
Published: 2026-09-18
Updated: 2026-09-18
Licence: CC BY-SA 4.0, https://creativecommons.org/licenses/by-sa/4.0/
Cite as: Murali Sid. Governance, risk & sovereignty. Agentic Architecture Skills. https://www.agenticarchitectureskills.com/library/layers/r11-governance-risk-sovereignty

---


Status: complete (published 2026-08-19). Scope finalized at Batch B kickoff with maintainer POV; see findings.md and sources.md.

## Scope inventory (v0) [#scope-inventory-v0]

* **Regulatory map**: EU AI Act obligations and timeline, NIST AI RMF, DORA, NIS2, sector regimes per vertical (HIPAA, FedRAMP, NERC CIP, RBI, DPDPA), cross-border transfer mechanisms
* **Operating governance**: AI council and use-case intake, risk tiering, impact assessments (DPIA/AIA), model risk management, third-party and procurement risk for agent vendors
* **Records and accountability**: retention and eDiscovery for agent memory and outputs, evidence packs for regulators, liability and the Sponsor pattern, insurance
* **Sovereignty**: deployment spectrum (managed API to air-gapped), classification-based routing, localization requirements

## Challenged-default candidates [#challenged-default-candidates]

AI governance platforms vs extending GRC tooling; sovereign cloud offerings vs region pinning with contractual controls. Each track proposes its final list at kickoff.

## Files [#files]

`findings.md` and `sources.md` carry this track's research. The scoping brief and the vendor map were archived on 2026-08-23 (see `archive/`, decision D038).