Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

EU AI Act for HR: Annex III Point 4 and the December 2027 Deadline

The current EU AI Act places recruitment, promotion, termination, task allocation, and worker-monitoring systems in Annex III point 4, subject to the Article 6(3) exception. Regulation (EU) 2026/1744 moved the main Chapter III high-risk duties for these systems to 2 December 2027. This guide separates the duties already in force from later high-risk controls. It also covers deployer notices, logging and retention, impact assessments, and explanation rights.

Compliance & Regulationeu-ai-acthrrecruitmenthigh-risk-aicompliancearticle-12
Read post →

Risk Manager AI Risk Checklist for Acceptance Decisions

This risk manager AI risk checklist turns one AI use into a documented acceptance, treatment, or rejection decision. It fixes the context of use, tolerance, owner, treatment, measures, production evidence, and change triggers before risk enters the register. Recurring reporting remains a separate process.

Compliance & Regulationai-governanceai-compliancenist-ai-rmfauditpolicy-enforcementcompliance
Read post →

Procurement Lead AI Risk Checklist for Contract Award

This procurement lead AI risk checklist turns an AI supplier selection into a signed contract-award and service-acceptance decision. It fixes the use boundary, maps required evidence to scored artifacts and contract commitments, tests evidence delivery and change notice, assigns the operating handoff, verifies exit portability, and records conditions before purchase.

Compliance & Regulationai-governanceai-compliancecomplianceauditnist-ai-rmfpolicy-enforcement
Read post →

Loom CVE-2026-103956: An IdP-Less Deployment Granted Super-Admin Access

CVE-2026-103956 gave unauthenticated requests a fixed super-admin identity when Loom for AWS had no Cognito user pool or active external identity provider. This article explains the precise vulnerable state, the 1.6.1 fix, and the deployment gate that should keep an agent management plane unreachable until identity is working.

Platform & Architectureai-securityagentic-aiidentity-and-authorizationmcp-securityarchitecture
Read post →

AI Data Protection for Wealth Management Starts Before Transmission

Wealth-management AI requests should reduce household profiles to the fields an approved task needs, then verify the adviser, application, provider account and route before transmission. SEC Regulation S-P safeguards and FINRA guidance anchor this pre-transmission policy, while advice, supervision, records and provider-internal processing stay with their established owners.

Industry Verticalsai-securityai-governanceai-compliancedata-loss-preventionpolicy-enforcementidentity-and-authorization
Read post →

Databricks AI Security Framework: Turn DASF Risks Into Control Tests

The Databricks AI Security Framework gives security teams a component-based risk catalog for AI systems. A useful implementation turns each applicable DASF risk into an owned control and a test on the real request path, with evidence that shows the result. This article explains that workflow and identifies the narrow HTTP enforcement slice that DeepInspect can cover.

Compliance & Regulationai-securityai-governanceai-complianceagentic-aipolicy-enforcementarchitecture
Read post →

Azure AI Content Safety Pricing: Records, Images, and Total Cost

Azure AI Content Safety pricing uses separate text-record and image meters. A Standard text record contains up to 1,000 Unicode code points, so longer inputs round into additional records, while images are counted individually. The total cost also depends on which APIs the application calls, how often it checks prompts and responses, and the Azure logging, model inference, engineering, and review work around the moderation service.

Comparisons & Alternativesai-securityllm-securitypolicy-enforcementarchitecturecloud-security
Read post →

AWS Bedrock Guardrails Pricing: Filters, Text Units, and Total Cost

AWS Bedrock Guardrails pricing is additive by safeguard. Text content is divided into units of up to 1,000 characters, image filtering is metered per image, and enabled filters create separate charge lines. The total also includes model inference and any independent ApplyGuardrail calls. Logging and testing add costs, as does application work. Accurate estimates therefore start with characters processed on each request and response, then apply the exact safeguards enabled.

Comparisons & Alternativesai-securityllm-securitypolicy-enforcementarchitecturecloud-security
Read post →

Arize AI Pricing: Plans, Span Limits, and Retention Costs

Arize AI pricing packages observability around three visible capacity limits: trace spans, ingestion volume, and retention. The Free and Pro plan cards publish fixed monthly allowances, while Enterprise uses custom capacity and can be SaaS or self-hosted. A useful estimate counts the spans created by each application run, the payload volume attached to them, and the retention period required for production analysis.

Comparisons & Alternativesai-governancellmarchitecturecloud-securityaudit
Read post →

AI Security Awareness Training for Employees Using LLMs

AI security awareness training should prepare employees to make specific decisions before a prompt is sent and after an LLM response returns. A role-based program uses realistic exercises for shadow AI, sensitive data, indirect prompt injection, output verification, and escalation, then measures observable behavior instead of attendance.

Problem-Awareai-securityllm-securityprompt-injectionshadow-aipolicy-enforcementcybersecurity
Read post →

G7 Hiroshima AI Process: Turn the Voluntary Code Into Evidence

The G7 Hiroshima AI Process produced international guiding principles and a voluntary code of conduct for organizations developing advanced AI systems. Its 11 actions cover lifecycle risk, incident handling, transparency, governance, security, provenance, standards, and data protections. Implementation requires several evidence owners, with HTTP request records supporting only the routed-use slice.

Compliance & Regulationai-governanceai-complianceregulationauditpolicy-enforcement
Read post →

Confidential Computing for AI: Protect Data During Processing

Confidential computing protects AI data and code while a CPU or GPU processes them inside a hardware-based, attested trusted execution environment. It complements encryption at rest and in transit. For enterprise AI, attestation, key release, workload identity, model routing, and request policy remain separate controls with separate evidence.

Platform & Architectureai-securitycloud-securityarchitecturezero-trustidentity-and-authorization
Read post →