Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.
NIST AI RMF GOVERN, MAP, MEASURE, MANAGE explained through four artifacts an AI program needs: a charter, inventory, evidence record, and action log. See what each function asks a team to own, how the records connect, and where they support regulatory or audit review.
Read post →EU Data Governance Act AI incident reporting is narrower than a general cyber-incident regime. Regulation (EU) 2022/868 requires data intermediation services providers and recognised data altruism organisations to inform data holders without delay after unauthorised transfer, access or use of shared non-personal data. This guide scopes the affected role, builds the incident record and separates DGA notifications from GDPR, NIS2 and contractual duties.
Read post →EU Data Act LLM requirements arise when hosted inference, vector storage, fine-tuning or related AI platforms qualify as data processing services. Chapter VI of Regulation (EU) 2023/2854 addresses switching, contract terms, charges and technical portability. Article 32 addresses conflicting third-country governmental access to non-personal data held in the Union. This guide separates those duties from model-safety rules and turns them into provider and customer engineering requirements.
Read post →An EU Data Act AI risk assessment should examine the data processing services around an AI deployment, especially switching, export, contract, interoperability and international access exposure. Regulation (EU) 2023/2854 creates no standalone AI risk-assessment form. This method turns its applicable duties into testable scenarios, assigns each risk to a legal or technical owner, and identifies the evidence needed before a provider switch or transfer question becomes urgent.
Read post →The EU Cyber Resilience Act regulates products with digital elements rather than LLMs as a technology category. An AI-enabled software product can bring model calls into its cybersecurity design, documentation, vulnerability handling, and reporting work. This article maps the manufacturer baseline for access, confidentiality, integrity, minimisation, monitoring, updates, and evidence, while separating product obligations from standalone cloud services and model APIs.
Read post →Article 13 of the EU Cyber Resilience Act requires manufacturers to assess and document cybersecurity risks throughout a product's lifecycle. For a product that depends on hosted LLM inference, the assessment must connect intended purpose, foreseeable use, assets, request paths, third-party components, and Annex I controls. This article provides a product-level method without treating every standalone model API or cloud service as directly regulated by the CRA.
Read post →Cyber Resilience Act reporting duties apply from 11 September 2026. Manufacturers of products with digital elements must report actively exploited vulnerabilities and severe security incidents through the Single Reporting Platform. This article turns the 24-hour, 72-hour, and final-report deadlines into an evidence workflow for products that make LLM calls, while keeping standalone cloud services and model APIs outside the scope unless they meet the Act's product or remote-processing tests.
Read post →Dropbox Dash compliance needs a provider assurance file and a deployment file for connected work apps, indexed content, access controls, AI processing, exclusions, administrative settings, and evidence retrieval. Dropbox documents Dash security, SOC 2 Type II and ISO/IEC 27001 scope, GDPR support, connector behavior, ACL enforcement, logging, and current US storage. The customer remains responsible for configuration, approved use, source permissions, retention, testing, and control ownership.
Read post →DeepSeek compliance depends on the service and deployment route an enterprise selects. The current public privacy policy, terms, and API documentation establish important facts about controller responsibility, input handling, training use, storage, model outputs, and the provider-facing interface. An enterprise approval should connect those terms to allowed data, user identity, model route, human review, retention, testing, change control, and per-request evidence.
Read post →Databricks Mosaic AI compliance needs two connected evidence sets: provider assurance for the Databricks service and operating evidence for each enterprise deployment. Unity Catalog and Unity Gateway can support access control, lineage, service policy, and audit records. The enterprise still has to document approved use, data scope, model routes, configuration, control tests, changes, retention, and accountable ownership.
Read post →The CSBS Artificial Intelligence Supervisory Framework gives state examiners a Core Examiner Guide, document request list, work program, nonbank supplements, and an optional risk-tiering worksheet. Financial institutions can prepare by connecting each AI use case to its owner, purpose, vendor, risk tier, data controls, change record, and operating evidence. The framework remains discretionary, and each state agency decides how to incorporate it.
Read post →AI incident response needs five connected categories: SIEM, EDR/XDR, SOAR, DLP/CASB, and a request-boundary AI traffic layer. This guide maps each category to containment and evidence work for an agent incident.
Read post →