Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

Fundamental Rights Impact Assessment (FRIA): The Article 27 Document Most Deployers Are Missing

Article 27 of the EU AI Act requires public bodies and private deployers of certain high-risk AI systems to perform a Fundamental Rights Impact Assessment before first use. The FRIA is a documented process covering intended purpose, persons affected, specific risks of harm, and human-oversight arrangements. It is distinct from a GDPR DPIA. This piece walks through what the FRIA includes, who has to perform one, the August 2026 trigger, and how per-decision records at the AI request boundary feed the FRIA evidence base.

Compliance & Regulationeu-ai-actfriacompliancefundamental-rightsauditregulation
Read post →

EU AI Act for Fintech: How Credit Scoring and Fraud Detection Become High-Risk in August 2026

On August 2, 2026 the EU AI Act high-risk system requirements begin to apply to fintech credit scoring, creditworthiness assessment, and several adjacent financial decisions. The classification falls under Annex III point 5(b). Deployers inherit Article 26 obligations including per-decision logging, human oversight, instructions for use, and incident notification. The provisions overlap with DORA on third-party risk and incident reporting. This piece walks through which fintech AI use cases become high-risk, what the deployer obligation actually requires, and where most lender deployments are exposed.

Industry Verticalseu-ai-actfintechcredit-scoringai-compliancefinancial-servicesaudit
Read post →

Fannie Mae LL-2026-04: the first sector-specific AI governance mandate for lenders

Fannie Mae Lender Letter LL-2026-04 was issued April 8, 2026 and takes effect August 8, 2026. It is the first sector-specific AI governance mandate in US mortgage lending. The Letter requires lenders to inventory AI usage, document data classification, attach identity context, and produce audit records for AI-influenced credit decisions. Freddie Mac Section 1302.8 has been enforced since March 3, 2026. This piece walks through the requirements, what they mean for the lender stack, and the architecture that satisfies them.

Compliance & Regulationfannie-maemortgageai-governancelendingcomplianceaudit
Read post →

EU AI Act Systemic-Risk Models: How the 10^25 FLOPs Threshold Triggers Article 55 Obligations

The EU AI Act treats a subset of general-purpose AI models as systemic-risk under Article 51, with the principal trigger set at 10^25 FLOPs of training compute. Models in that bucket inherit additional Article 55 obligations on model evaluation, systemic-risk assessment, serious-incident reporting, and cybersecurity. This article walks through the threshold mechanics, the Commission designation pathway, and the second-order obligations that flow to enterprise deployers integrating a systemic-risk model.

Compliance & Regulationeu-ai-actsystemic-riskcompliancegpairegulationfoundation-models
Read post →

EU AI Act Substantial Modification: When an Update Turns Your Deployer Into a Provider

Article 25 of the EU AI Act says a deployer who substantially modifies a high-risk AI system becomes a provider for that modified system. The provider obligations are heavier than the deployer obligations. Most enterprise teams discover this rule after they have fine-tuned a model, added a retrieval layer, or changed the intended purpose. This piece walks through what the regulation defines as substantial modification, the three updates most likely to trigger it, and the records you need to track every change at the AI request boundary.

Compliance & Regulationeu-ai-actcomplianceauditregulationprovider-obligations
Read post →

EU AI Act Post-Market Monitoring: Article 72 Obligations and the Plan That Survives an Audit

EU AI Act Article 72 requires providers of high-risk AI systems to establish and document a post-market monitoring system that actively and systematically collects, documents, and analyzes data on the performance of the system throughout its lifetime. The monitoring system must be proportionate to the nature of the AI technologies and the risks, and it must allow the provider to evaluate continuous compliance with the requirements of Chapter III, Section 2 of the regulation. With the August 2, 2026 high-risk enforcement date 34 days away, providers and deployers need a clear read on what the monitoring plan must contain, what data feeds it, and what artifacts an auditor expects to see.

Compliance & Regulationeu-ai-actcompliancepost-market-monitoringhigh-risk-airegulationarticle-72
Read post →

EU AI Act GPAI Code of Practice: What Foundation Model Providers Have to Sign Before August 2

The GPAI Code of Practice is the EU Commission instrument that operationalizes the August 2, 2026 General-Purpose AI obligations from the EU AI Act. Providers that sign the Code get a presumption of compliance with Articles 53 through 56. Providers that do not sign must demonstrate equivalent compliance by other means. This article walks through the Code chapters, the August 2 enforcement consequences, and what enterprise deployers downstream of a non-signatory provider need to add to their own control stack.

Compliance & Regulationeu-ai-actgpaicompliancefoundation-modelsregulationai-governance
Read post →

EU AI Act General-Purpose AI: Article 53 Obligations, the August 2 Deadline, and the Deployer Consequences

The EU AI Act separates general-purpose AI (GPAI) rules from the high-risk system rules. GPAI obligations under Articles 53 through 55 sit with the model providers (OpenAI, Anthropic, Google, Mistral, Meta) and take effect August 2, 2026. Downstream deployers absorb second-order obligations through the technical documentation and evaluation records upstream providers must supply. This piece walks through what Article 53 requires from GPAI providers, what the systemic-risk threshold under Article 55 changes for the frontier labs, and the practical inspection-layer records a deployer running GPT-5, Claude 4, or Gemini 3 needs to keep against Articles 12, 13, and 26 in parallel.

Compliance & Regulationeu-ai-actgpaigeneral-purpose-aiarticle-53article-55compliance
Read post →

EU AI Act FRIA Templates for Deployers: What the Article 27 Assessment Actually Has to Contain

Article 27 of the EU AI Act requires a Fundamental Rights Impact Assessment from certain deployers of high-risk AI systems before first use. The FRIA must cover the deployment process, the time period and frequency of use, the categories of natural persons affected, the specific risks of harm, the human oversight measures, and the measures to take if those risks materialize. The August 2, 2026 enforcement date means deployers of in-scope systems need a completed FRIA in hand at that point. This article walks through what Article 27 actually requires, which deployers are in scope, and the section-by-section structure a defensible FRIA needs.

Compliance & Regulationeu-ai-actcomplianceai-governanceregulationfundamental-rightsfria
Read post →

EU AI Act EU Database Registration: Article 49 Obligations for High-Risk Systems

EU AI Act Article 49 requires providers of most high-risk AI systems to register the system in the EU database for high-risk AI systems before placing it on the EU market or putting it into service. Article 49(2) creates a parallel obligation for public-authority deployers and certain EU institution deployers to register the systems they use. The database is maintained by the Commission and is publicly accessible for the information that is not commercially sensitive. With the August 2, 2026 high-risk enforcement date 34 days away, providers and the in-scope deployers need a clear read on what gets registered, who registers it, and what the registration record contains.

Compliance & Regulationeu-ai-actcompliancedatabase-registrationhigh-risk-airegulationarticle-49
Read post →

DeepInspect vs Kong AI Gateway: Where Each One Fits and Where the Two Layers Compose

Kong AI Gateway is the AI-focused extension of the Kong API Gateway. It adds multi-provider LLM routing, semantic caching, prompt templates, and consumption controls on top of the Kong data plane. DeepInspect sits at the same HTTP position but answers a different question: identity-bound policy on prompt content, per-route data classification, and a per-decision audit record formatted for EU AI Act Article 12 review. The two layers compose in production. This piece walks through what each one does and how the regulated workload pattern splits the responsibility.

Comparisons & Alternativeskong-ai-gatewayai-gatewaycomparisoninline-enforcementauditeu-ai-act
Read post →