Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

Connecticut SB 2 AI Compliance Checklist: Ten Items Before the October 2026 Deadline

A working checklist for organizations running AI over Connecticut consumer or employee data. Senate Bill 2 died in the House twice, so the live obligations sit in Public Act 26-15, signed 2 June 2026 with provisions from 1 October 2026, and in Connecticut Data Privacy Act amendments effective 1 July 2026 whose profiling impact assessment duty attached on 1 August 2026. Each item names the obligation, the concrete action, and the evidence it produces.

Compliance & Regulationcomplianceai-governanceregulationauditai-security
Read post →

CSA AICM AI Controls Mapping: 18 Domains and Four Owners Against One HTTPS Request

The CSA AI Controls Matrix, released 10 July 2025, holds 243 control objectives across 18 security domains, each tagged with an owner drawn from the cloud provider, model provider, orchestrated service provider, and application provider. This maps the domains that bite when a prompt leaves your network onto the technical control that enforces each one at the AI request boundary, the enforcement point where it fires, and the evidence artifact a STAR for AI assessment reads.

Compliance & Regulationcomplianceai-governancepolicy-enforcementcloud-securityai-security
Read post →

CSA AICM AI Audit Evidence: What a STAR for AI Assessment Asks You to Produce

The Cloud Security Alliance released the AI Controls Matrix on 10 July 2025 with 243 control objectives across 18 security domains, analyzed by control type, ownership, architectural layer, AI lifecycle stage, and threat category. STAR for AI assessments run against it. This walks the evidence artifacts an AICM assessment requests when a prompt carrying regulated data leaves your network, names the domain each artifact answers, and identifies which party in the shared-responsibility split has to produce it.

Compliance & Regulationcomplianceai-governanceauditcloud-securityai-security
Read post →

CSA CCM AI Audit Evidence: Running 197 Cloud Controls Against AI Traffic

The Cloud Controls Matrix holds 197 control objectives across 17 domains and maps to roughly 40 standards, which is why so many enterprises already run their cloud assurance against it. AI traffic lands inside that scope without a single new control, because a prompt is an outbound API call carrying regulated data. This walks the CCM domains an AI deployment touches, the evidence each one asks for, and where existing CCM answers stop being true.

Compliance & Regulationcomplianceai-governanceauditcloud-securityai-security
Read post →

CSA AICM AI Compliance Checklist: Ten Items Before a STAR for AI Self-Assessment

A working checklist for organizations preparing against the Cloud Security Alliance AI Controls Matrix, released 10 July 2025 with 243 control objectives across 18 security domains and an ownership dimension splitting each one between cloud, model, orchestration, and application providers. Each item names the domain, the concrete action, and the evidence it produces, so the list works as preparation for a STAR for AI Level 1 self-assessment rather than a reading exercise.

Compliance & Regulationcomplianceai-governanceauditcloud-securityai-security
Read post →

CSA CCM AI Controls Mapping: 17 Cloud Domains Against One Outbound Model Call

The Cloud Controls Matrix governs cloud consumption through 197 control objectives across 17 domains, and a prompt sent to a hosted model is cloud consumption. This maps the CCM domains that bite when AI traffic leaves your network onto the technical control that enforces each one, the point in the request path where it fires, and the evidence artifact a CSA STAR assessor reads. It also names the four domains whose existing answers stop being true the moment a model endpoint enters scope.

Compliance & Regulationcomplianceai-governancepolicy-enforcementcloud-securityai-security
Read post →

CSA CCM AI Compliance Checklist: Ten Items Before Your CAIQ Covers AI Traffic

A working checklist for teams whose Cloud Controls Matrix answers predate their first model endpoint. CCM v4 holds 197 control objectives across 17 domains and maps to roughly 40 standards, and the Consensus Assessments Initiative Questionnaire turns those into more than 250 answerable questions. Each item below names the CCM domain, the action to take at the AI request boundary, and the artifact it produces, so the list works as preparation for a STAR self-assessment rather than a reading exercise.

Compliance & Regulationcomplianceai-governanceauditcloud-securityai-security
Read post →

EU Cyber Resilience Act AI Compliance Checklist: Ten Items Before 11 September 2026

Article 14 reporting duties under Regulation (EU) 2024/2847 started on 11 September 2026, more than a year before the essential requirements apply on 11 December 2027, and they cover products already on the market. This checklist walks ten actions for a product with digital elements that calls a hosted model: the Annex I point each one answers, the work involved at the AI request boundary, and the artifact it produces for a 24-hour early warning, a notified body, or a market surveillance authority.

Compliance & Regulationcomplianceregulationai-governanceauditai-security
Read post →

EU Cyber Resilience Act AI Audit Evidence: What the 24-Hour Clock Asks You to Produce

Reporting duties under the EU Cyber Resilience Act start on 11 September 2026, ahead of full application on 11 December 2027. From that date a manufacturer has 24 hours to send an early warning to ENISA and its CSIRT coordinator once it has reasonable certainty of an actively exploited vulnerability or a severe incident. This walks the Annex I requirements that an embedded LLM call touches, and the specific artifacts an assessor, a notified body, or a 24-hour report asks you to produce.

Compliance & Regulationcomplianceregulationai-governanceauditai-security
Read post →

EU Cyber Resilience Act AI Controls Mapping: Annex I Against the Outbound Model Call

Annex I of Regulation (EU) 2024/2847 splits into properties the product must have and processes the manufacturer must run. For a product that calls a hosted model, most of those properties get exercised in a single HTTPS request leaving the product boundary. This maps the Annex I points and the Article 14 reporting duty onto the technical control that enforces each one, the point in the request path where it fires, and the evidence a notified body or a market surveillance authority reads.

Compliance & Regulationcomplianceregulationpolicy-enforcementai-governanceai-security
Read post →

EU Data Act AI Controls Mapping: Switching, Residency and Trade Secrets at the Request Boundary

Chapter VI of Regulation (EU) 2023/2854 governs switching between data processing services, Article 32 governs third-country governmental access to non-personal data held in the Union, and Articles 4 and 5 carry trade-secret protections into shared data. This maps those obligations onto the technical control that enforces each one for AI traffic, the point in the request path where it fires, and the evidence artifact a customer, a regulator, or an exit clause reads.

Compliance & Regulationcomplianceregulationpolicy-enforcementai-governanceai-security
Read post →

EU Data Act AI Audit Evidence: Proving Where Your Prompts Went and How They Leave

Regulation (EU) 2023/2854 became applicable on 12 September 2025, and from 12 January 2027 providers of data processing services may impose no switching charges at all. Two chapters land hard on AI traffic: the switching and interoperability rules in Chapter VI, and Article 32 on international governmental access to non-personal data held in the Union. This walks the Data Act obligations an AI deployment touches and the specific artifacts a regulator, a customer, or an exit clause asks you to produce.

Compliance & Regulationcomplianceregulationai-governanceauditai-security
Read post →