28 point compliance checklist for shipping AI agents into enterprise environments

We keep getting the same question from teams trying to close enterprise deals. What do we actually need to pass a security review? So we compiled the checklist. 28 items across 6 categories, each mapped to at least one framework (EU AI Act, SOC 2 Type II, ISO 42001, or NIST AI RMF). Quick summary Logging (6 items) - log every prompt/response with timestamps, capture the full decision chain (not just input/output), retain for 6+ months, make logs tamper-evident. Most teams fail here first because compliance logging is different from developer logging. Access control (5 items) - auth on every endpoint, RBAC, scoped API keys, credential rotation, failed auth tracking. We still see unauthenticated agent endpoints in production more often than you'd think. Data handling (5 items) - classify what flows through your agent, scan outputs for secret leakage before they reach users, document your processing pipeline, handle data residency for EU customers. Security testing (5 items) - adversarial testing before every release, document methodology and results, maintain a vulnerability disclosure process, track dependencies, test MCP/tool integrations separately. Runtime protection (4 items) - input scanning on every message, anomaly detection, rate limiting, and a kill switch that gets you to zero traffic in under 60 seconds. Incident response (3 items) - AI-specific IR plan, severity levels for agent incidents, and actually practicing your response with tabletop exercises. For most early-stage products, items 1-11 and 17-18 unblock enterprise deals fastest. If SOC 2 is your priority, start with logging and access control. If targeting EU markets, focus on retention and adversarial testing documentation.