Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.
FFIEC AI controls mapping should connect each technology-neutral examination anchor to a scoped AI control, accountable owner, enforcement point, repeatable test, retained evidence, current result, and open gap. This guide builds that map across governance, inventory, lifecycle, access, logging, providers, resilience, and assurance.
Read post →This EU MDR AI compliance checklist turns intended purpose, software classification, technical documentation, quality management, post-market surveillance, change control, and routed LLM evidence into owner-assigned tests. Each check has a pass condition and retained artifact, with the request gateway boundary stated plainly.
Read post →This FERPA AI controls mapping connects disclosure authority, legitimate educational interest, identity, purpose, destination policy, audit records, retention, and vendor evidence to named owners and repeatable tests. It keeps the authenticated HTTP enforcement boundary separate from consent, contract, student-rights, endpoint, and legal obligations.
EU MDR AI audit evidence should let a notified body move from a selected device to its intended purpose, approved software configuration, risk and validation records, field signals, changes, and corrective actions. This guide builds that assessor package while keeping routed LLM evidence inside its actual HTTP boundary.
Read post →This FDA AI/ML guidance AI compliance checklist gives medical-device teams seven gradable checks for scope, lifecycle documentation, data and validation, PCCP changes, quality-system records, postmarket response, and routed LLM traffic. Each check names an owner, pass condition, retained evidence, and remediation state without presenting nonbinding guidance as a regulation.
Read post →FERPA AI audit evidence should reconstruct each governed disclosure of personally identifiable information from education records, including the recipient, legitimate interest, authority, identity, purpose, policy decision, and retained record. This guide separates request-layer evidence from consent, contract, student-access, and vendor-governance records owned elsewhere.
A COPPA AI controls mapping should connect each Part 312 duty to an accountable owner, control point, test, and evidence artifact. This mapping covers scope, notice, consent, parental rights, minimization, security, vendors, retention, and the limited enforcement available on routed HTTP LLM calls.
Read post →FDA AI/ML guidance audit evidence should let a reviewer trace an AI-enabled device software function through its intended use, development data, validation, approved change route, deployed configuration, and postmarket signals. This guide builds a reviewer-selected evidence package while separating nonbinding FDA guidance from the binding Quality Management System Regulation.
Read post →This FDA AI/ML guidance AI controls mapping connects lifecycle documentation, model data, validation, PCCP changes, QMS records, postmarket response, and routed LLM traffic to a control objective, accountable owner, enforcement point, repeatable test, retained artifact, and explicit boundary. It preserves the difference between draft guidance, final guidance, and regulation.
Read post →This EU MDR AI controls mapping links each medical-device software objective to an accountable owner, control point, repeatable test, retained evidence, and explicit boundary. It covers intended purpose, technical documentation, changes, post-market surveillance, CAPA, and routed LLM requests without assigning full conformity to one technical component.
Read post →The September 2026 CISA advisory, published with NSA and FBI, describes transfer stations that resell access to frontier models while obscuring origin and spreading requests across accounts and providers. I explain the distributed traffic mechanism and the enterprise egress evidence it changes, along with the exact boundary of an identity-aware HTTP policy gateway.
Compare DeepInspect and HiddenLayer across runtime LLM enforcement, model scanning, identity context, and audit evidence. Use the request path and artifact pipeline to decide where each platform fits.
Read post →