ADLC compliance: Mapping agentic development to NIST SSDF, OWASP, and the EU AI Act | Endor Labs

What it claims

Endor Labs maps NIST SSDF, the two OWASP GenAI lists and the EU AI Act onto coding-agent work. The map is pinned to specific editions: NIST SP 800-218 (SSDF v1.1), SP 800-218A (July 2024), the OWASP Top 10 for LLM Applications 2025, the OWASP Top 10 for Agentic Applications (released December 2025, labeled 2026), and the EU AI Act as amended by Regulation (EU) 2026/1744. The page says no official crosswalk exists and that its map is not legal advice. It also argues that existing SAST, SCA, secrets detection, container scanning and signing carry over unchanged. New controls are needed only on the action surface.

How it works

The SSDF anchors, by practice group:

• PO.1, PO.3, PO.5: a versioned agent policy covering allowed commands and MCP servers. The agent counts as part of the toolchain.
• PS.1–PS.3: agent sessions cannot read signing keys or edit CI configuration without a policy exception.
• PW.4: agent-proposed packages pass the same SCA checks at install time. Models, MCP servers, skills and plugins go into one inventory with provenance, which also covers OWASP LLM03 and ASI04.
• RV.1–RV.3: findings are prioritized by reachability, which serves as the RV.2 record.

OWASP risks are read twice. First, the coding agent is itself the LLM application at risk, through LLM01/ASI01, LLM06/ASI02, LLM02 and LLM03/ASI04. Second, the lists apply to AI features the team ships, under SSDF PW.1 and PW.2.

The EU AI Act scoping path:

flowchart TD
  A[Coding agents used internally only?] -->|Yes| B[Deployer: Article 4 AI literacy, keep training records]
  A -->|Shipping AI system or GPAI model| C{Provider or deployer?}
  C -->|Provider, Art. 3 / Art. 25| D{High-risk? Art. 6, Annex I/III}
  C -->|Deployer| E[Narrower duties, Art. 26 if high-risk]
  D -->|Yes| F[Arts. 9, 11, 12, 14, 15]
  D -->|No| G[Check Art. 50 transparency]

The page traces one control, blocking unapproved MCP servers, across all three frameworks. It maps to SSDF PO.3, PO.5 and PW.4, and to OWASP LLM03, ASI04 and ASI02. It has no direct EU AI Act provision for internal use, though it supports Article 15 for high-risk products. The evidence is the allowlist, the policy definition, and block logs with agent, user and timestamp.

How to use it

The audit test is whether a control holds regardless of what the model decides. Under that test, a system-prompt rule is a request, not a control. Agent-reported test results fall under LLM09 misreporting. Evidence must come from CI, scanners, policy-engine logs or signed artifacts.

Suggested first steps:

1. Inventory agents, models, MCP servers and skills inside the SBOM process.
2. Ship three deterministic rules: block destructive commands, block credential-file access, and allowlist MCP servers.
3. Generate evidence automatically per build and per agent session.
4. Run the scoping path and document the outcome, even "does not apply".

Limits

Key dates as the page gives them:

• 2 February 2025: prohibitions and AI literacy duties applied.
• 2 August 2025: GPAI model obligations applied.
• 2 August 2026: most Article 50 transparency duties applied.
• 2 December 2027: Annex III high-risk obligations apply, moved from 2 August 2026 by the Digital Omnibus, in force since 27 July 2026.
• 2 August 2028: Annex I obligations apply, moved from 2 August 2027.

The page tells readers to check EUR-Lex for later changes. It also notes that SSDF v1.2 (SP 800-218 Rev. 1) was a December 2025 draft, so practice IDs should be checked before citing them. Its SSDF IDs are "indicative" anchors at practice level, not task level. SP 800-218A mainly targets model producers, so for teams that only use agents it works as a vendor checklist. The page is vendor content: the reachability, Artifact Signing, Coding Agent Governance and AURI sections promote Endor Labs products. It gives no measured results for any of them.