By Anca Sailer, Vikas Agarwal, Thalia Hooker | Co-Authors, AI Safety Best Practices for Regulated Environments
After more than a year of collaboration across IBM, Red Hat, and a dozen contributing organizations, our working group has published a new LF AI & Data report that the industry has genuinely needed: a practitioner-grade guide to AI safety for the regulated environments where the stakes are highest, including healthcare, finance, and critical infrastructure.
Here is what we found, and why it matters.
Traditional Cybersecurity Frameworks Do Not Cover AI Safety
Organizations deploying AI in regulated industries already have mature frameworks: NIST SP 800-53, ISO/IEC 27001, PCI DSS. Those are well-tooled and widely adopted. But they were never designed for AI-specific risk.
A firewall does not protect you from a model producing subtly biased loan decisions. A vulnerability scanner does not catch training data poisoning. An intrusion detection system has no concept of hallucination rates or fairness drift.
We needed a framework that lives alongside traditional cybersecurity, not instead of it. That is what this white paper is.
Five Root Categories of AI Risk
Drawing on the AI Alliance Risk Atlas Nexus, NIST AI RMF, and OWASP Top 10 for LLMs, we define five categories:
- Input Risks: Data bias, unverified training sources, and prompt injection.
- Inference Risks: Hallucinations, model drift, and emergent behaviors during execution.
- Output Risks: Harmful or privacy-leaking content reaching end users.
- Non-Technical Risks: Inadequate documentation and missing human oversight.
- Use Context Risks: Misuse, societal harm, and erosion of public trust.
Generative and agentic systems amplify all five simultaneously.
Agentic AI Introduces Risks That Individual Testing Will Not Catch
This is the area we think the industry most needs to focus on right now. Agentic systems (those that autonomously plan, invoke tools, and coordinate with other agents) introduce risks that only emerge from interaction, not from any individual component:
- Agents impersonating other agents with no cryptographic validation to catch it.
- Accountability gaps when one agent triggers actions through another.
- Adversaries injecting rogue agents into discovery registries most teams have never hardened.
- Compliance rules hardcoded into agent logic, making them impossible to audit or update without full redeployment.
The guidance here is concrete: use SPIFFE/SPIRE for workload identity, externalize governance policies as version-controlled runtime artifacts, and treat your agent registry as security-critical infrastructure.
Closing the Gap Between Regulation and Enforceable Policy
NIST AI RMF tells you that you need to mitigate training data bias. It does not tell you which MLflow metric to track, at what threshold, verified by what automated check. We call this the semantic gap.
Our three-phase methodology closes it: map risks to controls, use LLMs with SME validation to generate product-specific automatable rules, then express those rules in NIST OSCAL Component Definition format so they can be continuously verified in your CI/CD pipelines.
We have done this for 30+ open-source projects, from Apache Airflow to vLLM to LangChain. The results are open-source and available now.
Where to Start
If you are implementing incrementally, begin here:
- Deploy AI inference guardrails (NeMo Guardrails or Guardrails AI) targeting prompt injection detection above 95% and harmful content filtering above 99%.
- Require Model Cards via Kubernetes admission control before any model reaches production.
- Track fairness metrics continuously in MLflow alongside accuracy. Set threshold alerts.
Read the Full White Paper
The white paper includes layer-by-layer stack analysis, full regulatory framework mappings (EU AI Act, ISO 42001, NIST AI RMF), OSCAL Component Definition examples, and a 16-week Quick Start guide in the appendix.
AI Safety Best Practices for Regulated Environments, LF AI & Data Foundation
AI safety in regulated environments is not a future problem. It is a present one. The organizations building systematic, automated, continuously verified safety practices now will be the ones trusted to deploy AI where it matters most.
About the Authors:
Anca Sailer is a Distinguished Engineer at IBM, Vikas Agarwal is a Senior Technical Staff Member at IBM, and Thalia Hooker is a Technical Leader at Red Hat and co-authors of this white paper. Other authors include Nitin Shetty, Uman Ahmed Mohammed, Deniza Beslinger, Vinodkumar R Nair, Lou DeGenaro, Vincent Caldeira (Red Hat), Robert Ficcaglia (SunStone Secure), and colleagues from IBM and Red Hat.
