Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.
SOC 2 reports cover five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. AI deployments touch all five. The audit evidence that AICPA expects has to be operational, not architectural. Application logs and policy documents fail. The records that pass are per request.
Read post →A Business Associate Agreement with an AI vendor transfers HIPAA obligations under specific conditions. OpenAI, Anthropic, Microsoft, AWS, and Google offer BAAs to enterprise tiers. The agreement covers what the vendor does with PHI; it does not eliminate the covered entity duty to record disclosures.
Read post →HIPAA requires that PHI is redacted or de-identified before disclosure to entities outside a Business Associate Agreement. AI prompts routinely contain PHI. Inline redaction at the AI request boundary is the only architecture that produces the per-request evidence HHS expects under a HIPAA audit.
Read post →NIST AI RMF is a voluntary US framework. The EU AI Act is binding law with penalties reaching 35M EUR or 7% of global turnover. The two frameworks converge on the same operational evidence: per-request records that capture identity, classification, policy state, and decision outcome.
Read post →NIST AI RMF 1.0 defines four functions: Govern, Map, Measure, Manage. The framework is voluntary, but federal procurement and state AI laws increasingly cite it as the baseline. Implementation runs to dozens of decisions across identity, classification, policy enforcement, and audit. Most deployments stop at Govern.
Read post →SaaS companies that embed AI features in product flows are pulled into the EU AI Act through their customers. If the customer uses the SaaS in a high-risk use case, the customer is the deployer and the SaaS company is often the provider. The mandate takes effect August 2, 2026.
Read post →GDPR governs the processing of personal data. The EU AI Act governs the operation of AI systems. The two regimes overlap on automated decision-making and divergent on per-decision evidence. GDPR records describe what data is processed. AI Act records describe what an AI system did with a specific request.
Read post →A 23-item operational checklist for EU AI Act high-risk compliance, organized across scope, documentation, evidence, monitoring, and incident reporting. The mandate takes effect August 2, 2026. Items 12 to 18 are where most deployments fail.
Read post →EU AI Act compliance breaks into six operational workstreams: scope classification, technical documentation, conformity assessment, runtime evidence, deployer monitoring, and incident reporting. The mandate takes effect August 2, 2026. Most organizations are running three of the six and missing the rest.
Read post →Article 6 of the EU AI Act establishes a two-branch test for classifying an AI system as high-risk. Branch one covers safety components of regulated products. Branch two covers the Annex III use cases. The classification triggers the full operational regime from August 2, 2026.
Read post →Annex III of the EU AI Act lists the eight categories of AI systems classified as high-risk. Inclusion in Annex III triggers the full obligations of Articles 8 to 27 from August 2, 2026. Most enterprise teams are inside the scope without realizing it.
Read post →Article 99 of the EU AI Act sets three penalty tiers reaching 35M EUR or 7% of global turnover for prohibited practices, 15M EUR or 3% for high-risk non-compliance, and 7.5M EUR or 1% for supplying misleading information. The mandate takes effect August 2, 2026.
Read post →