Member briefing, November: OWASP’s new AI security guidance leads a quiet regulatory month

In short: None of the regulators we track recorded a new AI law, executive order or enforcement action in the past month, and the White House presidential actions from October 19 to November 5, 2026 include none on AI. The real change came from the OWASP GenAI Security Project, which now lists a 2026 Top 10 for LLM Applications, a new Agent Control Standard, a GenAI Red Teaming Manual and an exploit roundup covering July 1 to September 30, 2026. The next dated obligation is the EU AI Act’s ninth prohibition, which comes into effect in December 2026.

For AI program owners, this makes November a month for security and control work rather than legal change. The new OWASP material gives managers reference documents for testing, data protection and agent oversight. With no new rules this month, there is time to adopt them before the EU prohibition in December and the high-risk dates in 2027 and 2028. This briefing is educational, not legal advice.