Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

Brazil LGPD AI Controls Mapping: LGPD Articles to Enforcement Points

The LGPD (Law 13.709/2018) governs AI in Brazil today, and each of its articles attaches to a concrete moment in the AI request flow. This maps the LGPD obligations that bite when a prompt carrying personal data leaves your network, from the Article 6 accountability principle to Article 20 automated decisions and the Articles 33 to 36 transfer rules, onto the technical control and enforcement point that satisfies each. The mapping stays concrete: article, where it applies, the control, and the evidence produced.

Compliance & Regulationcomplianceai-governanceregulationpolicy-enforcementai-security
Read post →

Canada AIDA AI Audit Evidence: What an Audit Asks For Now That AIDA Never Passed

The Artificial Intelligence and Data Act died with Bill C-27 when Parliament prorogued on 6 January 2025, and it has not been reintroduced. Canadian AI programmes still face audits, run under PIPEDA accountability, Quebec Law 25 section 12.1, OSFI guidance, and the Treasury Board Directive on Automated Decision-Making. This walks the specific evidence artifacts those reviews ask for when a prompt carrying personal information leaves your network, and names which system each artifact has to come from.

Compliance & Regulationcomplianceai-governanceregulationauditai-security
Read post →

Canada AIDA AI Controls Mapping: Canadian AI Obligations to Enforcement Points

AIDA died with Bill C-27 on 6 January 2025, so Canadian AI governance runs on PIPEDA accountability, Quebec Law 25 section 12.1, OSFI model risk guidance, and the Treasury Board Directive on Automated Decision-Making. Each of those obligations attaches to a concrete moment in the AI request flow. This maps them onto the technical control and enforcement point that satisfies each, and names the evidence every control produces at the boundary where a prompt leaves your network.

Compliance & Regulationcomplianceai-governanceregulationpolicy-enforcementai-security
Read post →

Canada AIDA AI Compliance Checklist: Ten Items for Canadian AI Without a Federal AI Act

A working checklist for Canadian organizations running AI over personal information now that the Artificial Intelligence and Data Act has died with Bill C-27 and PIPEDA, Quebec Law 25, OSFI guidance and the Treasury Board Directive carry the load. Each item names the obligation, the concrete action, and the evidence it produces, so the list works as an audit-readiness pass. Ordered the way a Canadian privacy review moves: identity and accountability first, then consent and classification, then transfers, then automated decisions.

Compliance & Regulationcomplianceai-governanceregulationauditai-security
Read post →

China PIPL AI Audit Evidence: What the CAC Expects When a Prompt Leaves the Mainland

The Personal Information Protection Law has governed AI in China since 1 November 2021, layered since with the Interim Measures for Generative AI Services of 15 August 2023 and the AI content labelling rules of 1 September 2025. This walks the specific evidence a Cyberspace Administration of China review asks for when a prompt carrying personal information reaches a model, from the Article 24 automated-decision record to the Article 55 impact assessment and the cross-border thresholds, and names which system each artifact comes from.

Compliance & Regulationcomplianceai-governanceregulationauditai-security
Read post →

Cyera Buys Oasis Security for $1B: The Case for an Independent AI Control Plane

On 28 July 2026 Cyera agreed to buy Oasis Security for roughly $1 billion, about $700 million of it cash, weeks after raising $600 million at a $12 billion valuation. It is the second-largest cybersecurity deal of the year and the sixth platform absorption of an AI-agent or identity startup in twelve months. This reads the deal as category validation for identity-bound authorization of AI-agent activity, and sets out the RFP question a platform lead should ask about where that control sits.

Comparisons & Alternativesai-securityai-governanceidentity-and-authorizationagentic-aiarchitecture
Read post →

China PIPL AI Controls Mapping: PIPL Articles to AI Enforcement Points

The Personal Information Protection Law governs AI in China without amendment, because each obligation attaches to the handling of personal information whatever performs it. This maps the PIPL articles that bite when a prompt leaves your network, from the Article 24 automated-decision duties to the Article 55 impact assessment and the Articles 38 to 40 transfer rules with their March 2024 volume thresholds, onto the technical control and enforcement point that satisfies each, and the evidence every control produces.

Compliance & Regulationcomplianceai-governanceregulationpolicy-enforcementai-security
Read post →

COBIT AI Controls Mapping: 40 Objectives Against One HTTPS Request

COBIT 2019 spreads 40 governance and management objectives across five domains, and ISACA extended that structure to AI systems in a 2025 white paper without adding a single new objective. A handful of those objectives bite the moment a prompt leaves your network. This maps each one to the technical control that enforces it at the AI request boundary, the enforcement point where it fires, and the evidence artifact it produces for an internal audit review.

Compliance & Regulationcomplianceai-governancepolicy-enforcementauditai-security
Read post →

COBIT AI Audit Evidence: What an ISACA-Aligned Review Asks You to Produce

COBIT 2019 carries 40 governance and management objectives across five domains, and ISACA published a 2025 white paper applying them to AI systems. An internal audit run against COBIT asks for operational evidence rather than policy documents. This walks the artifacts a COBIT-aligned review requests when a prompt carrying regulated data leaves your network, names the objective each artifact answers, and identifies which system has to produce it.

Compliance & Regulationcomplianceai-governanceauditregulationai-security
Read post →

Connecticut SB 2 AI Audit Evidence: What the Attorney General Asks For Now That SB 5 Passed Instead

Senate Bill 2 passed the Connecticut Senate on 14 May 2025 and died in the House, the second session running. The law that actually arrived is Substitute Senate Bill 5, signed as Public Act 26-15 on 2 June 2026, alongside amendments to the Connecticut Data Privacy Act that took effect 1 July 2026 with profiling impact assessments from 1 August 2026. This walks the evidence artifacts a Connecticut review requests and names which system produces each one.

Compliance & Regulationcomplianceai-governanceregulationauditai-security
Read post →

COBIT AI Compliance Checklist: Ten Items That Move an AI Process Past Capability Level 1

A working checklist for teams whose AI programme is being graded against COBIT 2019, the ISACA framework of 40 governance and management objectives that a 2025 white paper extended across the AI lifecycle. Each item names the objective, the concrete action, and the evidence artifact it produces, because COBIT grades process capability on documented work products. Ordered the way an internal audit walkthrough moves: identity and classification first, then risk, then change control, then assurance.

Compliance & Regulationcomplianceai-governanceauditregulationai-security
Read post →

Connecticut SB 2 AI Controls Mapping: Public Act 26-15 and the Amended CTDPA at the Request Boundary

Connecticut SB 2 died in the House twice. The obligations arrived through Substitute SB 5, signed as Public Act 26-15 on 2 June 2026, and through Connecticut Data Privacy Act amendments effective 1 July 2026 that removed the word solely from the automated decision opt-out. This maps each live Connecticut AI obligation onto the technical control that enforces it at the request boundary, the enforcement point where it fires, and the evidence artifact it produces for the Attorney General.

Compliance & Regulationcomplianceai-governanceregulationpolicy-enforcementai-security
Read post →