Purpose
This matrix translates EU AI Act practice, the NIST AI RMF and Thailand's emerging AI regime into a concrete feature checklist for an AI agent platform — scoped to the must-have layer so the platform is defensible today and needs no re-architecture when the ETDA Draft AI Act is enacted.
Regulatory landscape (August 2026)
- ETDA Draft AI Act — consultation opened 2 July 2026; four-tier risk model; covers offshore providers; strict liability and localization terms for government/CII vendors; enactment expected in 1–3 years.
- BOT AI Risk Management Policy — in force since 12 September 2025; covers generative and agentic AI; FEAT principles.
- OIC AI Governance Guideline — in force 2025; underwriting and claims are high-risk; human in the final decision loop.
- DGA guideline — non-binding; PDPC draft AI guidelines (Feb 2026) require DPIAs for high-risk AI.
Nine feature groups
F1 Inventory & Risk Classification · F2 Human Oversight & Kill-Switch · F3 Audit Trail · F4 Data Governance · F5 Model & Vendor Risk · F6 Transparency · F7 AI Security · F8 Fairness · F9 Documentation Generator.
Architecture patterns
API gateway/interceptor · embedded LLM guard · specialized guard model · data-layer control · UI guardrails. Most regulated deployments combine three or more.
Sector add-ons and roadmap
Banking: FEAT board pack, segregation of duties. Insurance: mandatory human sign-off before adverse action. Government/CII: on-prem or sovereign cloud, air-gapped mode. Phase 1: F1–F3; Phase 2: F4, F8, F6; Phase 3: F5, F7, F9.
Gartner MQ 2026
Inaugural MQ (16 June 2026) narrowed 100+ vendors to 13. Leaders: IBM, ServiceNow, Truyo. Use it as a shortlist filter, not a substitute for fit assessment.
Not legal advice.