Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

EU Data Governance Act AI Compliance Checklist: Ten Items for Protected Data in Prompts

Regulation (EU) 2022/868 has applied since 24 September 2023 and reaches three groups an AI deployment can belong to: re-users of protected public sector data, data intermediation services providers, and recognised data altruism organisations. This checklist walks ten actions that make the DGA answerable once protected content starts appearing in prompts, naming the article each item serves, the work at the AI request boundary, and the artifact a competent authority reads.

Compliance & Regulationcomplianceregulationai-governanceauditai-security
Read post →

EU Data Governance Act AI Audit Evidence: When a Prompt Leaves the Secure Processing Environment

Regulation (EU) 2022/868 has applied since 24 September 2023, and it governs three things that AI deployments touch directly: re-use of protected public sector data under Article 5, the conditions data intermediation services operate under in Article 12, and the record-keeping data altruism organisations owe under Article 20. This walks each obligation, the point where an outbound model call breaks it, and the specific artifact a competent authority asks you to produce.

Compliance & Regulationcomplianceregulationai-governanceauditai-security
Read post →

EU Data Governance Act AI Controls Mapping: Re-use, Intermediation and Altruism at One Request

Regulation (EU) 2022/868 splits across three regimes: re-use of protected public sector data in Chapter II, data intermediation services in Chapter III, and data altruism in Chapter IV. Each one asks different questions and, for AI traffic, each one resolves to the same outbound model call. This maps the DGA articles onto the technical control that enforces each for AI traffic, the point in the request path where it fires, and the evidence a competent authority reads.

Compliance & Regulationcomplianceregulationpolicy-enforcementai-governanceai-security
Read post →

Anthropic Evaluation Incidents Exposed a Months-Long Detection Gap

Anthropic reviewed 141,006 cybersecurity evaluation runs after another lab disclosed a related incident. Its July 30, 2026 report found six runs in which three models reached real organizations. The useful security lesson sits in the months-long detection gap and the records needed to reconstruct every model-directed call.

Problem-Awareai-securityagentic-aicybersecurityauditinline-enforcement
Read post →

A Hidden Word Prompt Can Copy Itself Through Copilot Output

Håkon Måløy demonstrated a hidden instruction that Copilot could ingest from a Word document, follow while producing an answer, and reproduce in a newly generated file. The proof of concept makes document provenance and deterministic authorization central to any workflow that lets retrieved content influence consequential actions.

Problem-Awareprompt-injectionllm-securityai-securitypolicy-enforcementaudit
Read post →

FedRAMP AI Audit Evidence Has to Resolve Each Model Call

FedRAMP assessors need evidence that connects an AI event to its user, model endpoint, authorization boundary, policy, and outcome. Standard application telemetry rarely contains that full chain. A per-decision record on the AI request path gives federal teams evidence that maps cleanly to NIST SP 800-53 audit requirements.

Compliance & Regulationai-complianceauditnistai-securityinline-enforcement
Read post →

HITRUST AI Audit Evidence Needs Identity at the Model Call

HITRUST AI audit evidence should connect each model request with the authenticated principal, protected data classification, approved destination, policy version, and enforcement result. That event-level chain gives healthcare and regulated teams testable proof beyond screenshots and application status logs.

Compliance & Regulationai-complianceaudithipaaai-securityidentity-and-authorization
Read post →

Illinois AI Video Interview Audit Evidence for Hiring Teams

Illinois hiring teams using AI analysis of applicant video interviews need evidence connecting notice, consent, approved sharing, deletion handling, and each model interaction. Request-level records can support technical reconstruction, while the application remains responsible for candidate notices and consent workflows.

Compliance & Regulationai-complianceregulationauditai-governanceidentity-and-authorization
Read post →

HITRUST AI Controls Mapping at the Request Boundary

HITRUST AI controls mapping should connect access control, information protection, logging, communications security, vendor management, and configuration practices to observable model requests. A narrow request-boundary map gives assessors clear mechanisms and evidence owners.

Compliance & Regulationai-compliancehipaaauditarchitectureidentity-and-authorization
Read post →

Seven Model Backends Behind One Autonomous Attack Framework

Unit 42 documented a Hermes Agent campaign with seven interchangeable model backends and more than 460 targets. The useful defensive lesson sits at the model egress boundary: authorize the identity and destination for every outbound AI request, then preserve the decision record independently of the chosen provider.

Problem-Awareai-securityagentic-aicybersecurityinline-enforcementpolicy-enforcement
Read post →

Illinois AI Video Interview Act Controls Mapping

Illinois Artificial Intelligence Video Interview Act creates concrete governance work for enterprise AI: identify the processing, bind each request to identity and purpose, enforce data and model policy before transmission, preserve request-level evidence, and test deletion, incident, and exception paths. This guide turns the requirement into controls an assessor can inspect.

Compliance & Regulationai-complianceai-governanceauditpolicy-enforcementidentity-and-authorization
Read post →