Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

EU AI Act Article 9: What the Risk Management System Obligation Requires

Article 9 of the EU AI Act requires a risk management system for every high-risk AI system, running as a continuous iterative process across the lifecycle. The obligations include risk identification, risk estimation, risk evaluation, and the adoption of risk management measures. The August 2, 2026 deadline applies. Most enterprise AI deployments treat risk management as a documentation exercise that ends at conformity assessment. The Article 9 reading expects an operating system that produces evidence at every decision point.

Compliance & Regulationeu-ai-actarticle-9risk-managementcompliancehigh-risk-aigovernance
Read post →

EU AI Act Importers and Distributors: The Lesser-Known Article 23 and Article 24 Obligations

Article 23 covers importer obligations and Article 24 covers distributor obligations for high-risk AI systems in the EU. The roles get conflated with provider and deployer roles in practice. An importer is the operator that places a high-risk AI system from outside the EU onto the EU market. A distributor is the operator that makes a high-risk AI system available in the EU market without being the importer or the provider. Both have specific verification obligations before the system reaches the deployer. With the August 2, 2026 enforcement date approaching, EU resellers and EU branches of non-EU vendors need to understand which obligations belong to them.

Compliance & Regulationeu-ai-actcomplianceai-governanceregulationhigh-risk-aiimporter-distributor
Read post →

What the EU Commission''s May 2026 High-Risk Classification Guidelines Change About Your AI Scope Assessment

On May 19, 2026, the European Commission published its draft guidelines clarifying which AI systems fall within the high-risk classification under Annex III of the EU AI Act. The guidelines arrive 75 days before the August 2 enforcement date for high-risk obligations. They tighten the criteria for "intended purpose," reshape how deployers and providers classify HR screening, clinical decision support, and fraud detection systems, and accelerate the scope assessment timeline. This article walks through the new criteria, applies them to three concrete enterprise deployments, and identifies the per-decision evidence each will need to produce on demand from August 2 onward.

Compliance & Regulationeu-ai-acthigh-risk-aicomplianceannex-iiiclassificationenforcement
Read post →

EU AI Act Fines vs GDPR Fines: How the Two Penalty Regimes Compare

The EU AI Act and GDPR operate parallel penalty regimes. GDPR caps the highest tier at 20 million EUR or 4% of global annual turnover. The AI Act caps its highest tier at 35 million EUR or 7% for prohibited AI practices, with 15 million EUR or 3% for high-risk non-compliance and 7.5 million EUR or 1% for misleading information. The two regimes can apply concurrently. This piece walks through the tiers, the trigger conditions, the enforcement bodies, and where the obligations actually overlap.

Compliance & Regulationeu-ai-actgdprcompliancepenaltiesregulationfines
Read post →

EU AI Act Deployer vs Provider: Who Owns Which Obligation in a High-Risk Deployment

The EU AI Act splits obligations between the provider that places an AI system on the market and the deployer that puts it into use. The split matters because deployers regularly assume they only have to consume the provider''s documentation, while providers regularly assume the deployer carries the runtime-evidence burden. Both assumptions leave gaps the regulator will surface. This article walks through the provider obligations under Articles 16, 17, and 43, the deployer obligations under Article 26, the shared traceability obligation under Article 12, and the operational division most enterprise deployments need to land before the August 2, 2026 enforcement date for high-risk systems.

Compliance & Regulationeu-ai-actcompliancedeployer-obligationsprovider-obligationshigh-risk-aiarticle-26
Read post →

EU AI Act Deployer Checklist: 22 Items Every Enterprise Deployer Needs Before August 2, 2026

August 2, 2026 is the enforcement date for the high-risk system obligations under Chapter III, Section 2 of the EU AI Act. Most enterprise compliance teams have a checklist for the provider-side obligations. Fewer have a structured checklist for the deployer side, where the runtime-evidence obligation lands. This article walks through 22 specific items a deployer of a high-risk AI system needs to have in place before August 2, organized into pre-deployment artifacts, runtime-evidence infrastructure, human oversight workflow, notification mechanisms, and ongoing operational requirements. Each item references the specific article of the act it satisfies.

Compliance & Regulationeu-ai-actdeployer-obligationscompliance-checklistarticle-26enforcementaugust-2026
Read post →

EU AI Act Article 72: Post-Market Monitoring as a Runtime Architecture Requirement

Article 72 of the EU AI Act requires providers of high-risk AI systems to set up and document a post-market monitoring system that actively and systematically collects data on the performance of the AI throughout its lifetime. The monitoring has to feed back into the risk management process under Article 9 and into the technical documentation under Article 11. The architectural requirement is for a runtime evidence pipeline, not for periodic reporting. Most providers run product analytics and call it post-market monitoring, and the regulator will not accept that under inspection.

Compliance & Regulationeu-ai-actai-governancecompliancemonitoringauditregulation
Read post →

EU AI Act Article 50: Transparency Obligations for AI Systems Interacting with People

Article 50 of the EU AI Act applies to AI systems that interact directly with people, generate synthetic content, or perform emotion recognition or biometric categorization. The obligation is to inform the affected person that they are interacting with an AI system or that the content they are seeing is AI-generated. The disclosure has to be clear, in time, and recorded as evidence. The architectural requirement runs to the AI request boundary and to the audit trail. Most production deployments handle disclosure as a UX choice and never wire it into an evidence layer.

Compliance & Regulationeu-ai-actai-governancecompliancetransparencyai-securityregulation
Read post →

Dynamo AI Alternatives: Three Options and Where Runtime Enforcement Fits

Dynamo AI came out of MIT research on privacy and federated learning, and its platform now spans DynamoEval for adversarial testing, DynamoEnhance for remediation, and DynamoGuard for real-time guardrails. Teams look at alternatives when they want deeper agent evaluation, an observability tie-in, or identity-bound authorization on live model calls. This lays out three alternatives and where a runtime enforcement layer sits, with honest notes on what each is built to do.

Comparisons & Alternativesai-securitycomparisonai-governancepolicy-enforcementauditeu-ai-act
Read post →

DeepInspect vs Prompt Security: Architecture, Audit, and Buyer Fit

Prompt Security and DeepInspect both intercept HTTP traffic to LLMs and apply policy. The architectures differ on what counts as policy, what identity model the audit trail carries, and which regulatory regimes the products are aligned to. Prompt Security focuses on prompt-level security and shadow AI detection across SaaS surfaces. DeepInspect focuses on identity-bound policy enforcement and per-decision audit evidence for regulated AI deployments. This piece compares the two on architecture, enforcement model, audit posture, and buyer fit.

Comparisons & Alternativescomparisonprompt-securityai-securityai-gatewayauditai-governance
Read post →

DeepInspect vs Cloudflare AI Gateway: When Each Architecture Fits

DeepInspect and Cloudflare AI Gateway both sit between applications and LLM endpoints, and both call themselves AI gateways. The architectures differ in what they enforce, what they record, and which compliance regimes they support. Cloudflare AI Gateway is built for observability, caching, and routing at the edge. DeepInspect is built for identity-bound policy enforcement and per-decision audit evidence in regulated environments. This piece compares the two on architecture, enforcement model, audit posture, and the buyer fit for each.

Comparisons & Alternativescomparisonai-gatewaycloudflareai-securityai-governanceaudit
Read post →

California SB 942 AI Controls Mapping: Obligations to What a Proxy Can and Cannot Enforce

The California AI Transparency Act (SB 942) takes effect 2 August 2026 after AB 853 delayed it. Its obligations split cleanly into two groups: content-provenance duties that live at the model and generation layer, and deployer-side evidence duties that live in the traffic. This maps each SB 942 obligation to the control that satisfies it, and marks honestly which ones an HTTP enforcement point can produce evidence for and which belong to the covered provider. Precision on that boundary is the point.

Compliance & Regulationcomplianceai-governanceregulationpolicy-enforcementai-security
Read post →