Joint Letter to NIST on the RFI re: Security Considerations for AI Agent Systems

Ladies and Gentlemen:

BITS, the technology policy division of the Bank Policy Institute ("BPI/BITS"), together with the American Bankers Association (“ABA”), submit these comments in response to CAISI's Request for Information regarding security considerations for AI agent systems. BPI/BITS and ABA member banks are actively evaluating and deploying generative AI, including the use of AI agents across cybersecurity, fraud prevention, operations, and customer support.

As agent systems become more widely used and paired with tools that take actions affecting real-world systems and environments, it’s important to carefully evaluate risks and ensure effective guardrails are in place. Financial institutions already govern these risks through established risk management, compliance, and oversight processes, with implementation tailored to the nature, scale, and risk of the use case. Banks have long used AI in their businesses and operations, including for risk management, and are committed to deploying these capabilities responsibly. However, as agent systems increasingly interact with enterprise services and external platforms, additional industry coordination can help ensure that these interactions remain secure, traceable, and interoperable.

The following comments address two areas where standardization can both accelerate adoption and enhance supply chain risk management: (1) documentation and controlled sharing for agent deployments, and (2) secure interactions and automated integrations with counterparties. NIST's CAISI can play an important role in convening industry, researchers and government to develop voluntary, consensus-based guidance. These recommendations are intended to support CAISI's role in defining common terminology, baseline information elements, and reference examples. They are not intended to prescribe implementation choices, require public disclosure, or establish an examination checklist.

Download the joint comment letter to read the full text.