NIST sets fall 2026 release for first two SP 800-53 AI control overlay volumes

NIST is preparing to release the first two volumes of a planned five-volume series that tailors its SP 800-53 security and privacy controls for AI systems.

On October 23, 2026, GovCIO Media reported that the project lead said the two volumes would come out this fall.

What it is

The effort, now called the Control Overlays for Super Intelligence Systems (COSIS), was previously named Control Overlays for Securing AI Systems (COSAiS) and was renamed to match the government's preferred terminology for AI.

It adapts the existing SP 800-53 catalog to AI systems, including predictive, generative and agentic applications, and covers components such as training data, model weights and configuration settings.

The overlays also draw on SP 800-218A, the draft AI 800-1 misuse-risk guidance, and the AI 100-2e2025 adversarial machine learning taxonomy.

What it requires

When finished, the series will include five volumes: a methodology volume, plus overlays for predictive systems, generative systems, agentic systems and AI software developers.

The first volume to ship covers NIST's development methodology, and the second covers predictive systems.

NIST describes the overlays as a partial solution that organizations must still customize for their own networks.

What security leaders should do

Security teams already running SP 800-53 programs can treat the methodology volume as a map for scoping AI-specific risks to training data, model weights and agent behavior before the later use-case overlays arrive. Because the predictive-systems overlay is the first substantive volume, organizations with predictive AI deployments in production or procurement pipelines should prioritize reviewing it against current risk assessments once published. Teams should also track the project's companion work, the Cyber AI Profile, since NIST intends the two efforts to complement each other.