What happened
NIST's Request for Information on modernizing the NVD in the age of artificial intelligence (Federal Register docket NIST-2026-0100) is open for comment until 13 October 2026 (in the reporting window; ~73 comments received to date). The RFI seeks input across seven topic areas including AI-enabled vulnerability prioritisation, AI-generated remediation safeguards, vulnerability data governance/machine-readability, and NIST's emerging agentic AI workflow for NVD enrichment; NIST noted CVE submissions grew 263% from 2020 to 2025 with Q1 2026 up ~1/3 YoY.
Why it matters
This is a Tier-1 NIST consultation on how AI (including agentic AI) will reshape global vulnerability management infrastructure. Its outcome will drive standards, data formats and tooling for vulnerability management vendors, software supply-chain operators and security platforms that integrate with NVD — central to AI-era vulnerability management practice.
Action needed
Vulnerability management vendors and affected enterprises should submit comments on the RFI by 13 October 2026 (Regulations.gov, docket NIST-2026-0100), particularly on AI agent autonomy in NVD enrichment and human-review thresholds.