Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

California SB 942 AI Controls Mapping: Obligations to What a Proxy Can and Cannot Enforce

The California AI Transparency Act (SB 942) takes effect 2 August 2026 after AB 853 delayed it. Its obligations split cleanly into two groups: content-provenance duties that live at the model and generation layer, and deployer-side evidence duties that live in the traffic. This maps each SB 942 obligation to the control that satisfies it, and marks honestly which ones an HTTP enforcement point can produce evidence for and which belong to the covered provider. Precision on that boundary is the point.

Compliance & Regulationcomplianceai-governanceregulationpolicy-enforcementai-security
Read post →

California SB 942 AI Compliance Checklist: Ten Items Split by Who Actually Owns Each One

A working checklist for the California AI Transparency Act (SB 942), operative 2 August 2026 after AB 853 delayed it. The list is split deliberately: the provenance and detection items a covered provider owns at the generation layer, and the evidence and verification items a deployer or licensee owns in the traffic. Each item names the action, who owns it, and the evidence to produce, so nobody assumes the vendor covered their side.

Compliance & Regulationcomplianceai-governanceregulationauditai-security
Read post →

Canada AIDA AI Audit Evidence: What an Audit Asks For Now That AIDA Never Passed

The Artificial Intelligence and Data Act died with Bill C-27 when Parliament prorogued on 6 January 2025, and it has not been reintroduced. Canadian AI programmes still face audits, run under PIPEDA accountability, Quebec Law 25 section 12.1, OSFI guidance, and the Treasury Board Directive on Automated Decision-Making. This walks the specific evidence artifacts those reviews ask for when a prompt carrying personal information leaves your network, and names which system each artifact has to come from.

Compliance & Regulationcomplianceai-governanceregulationauditai-security
Read post →

Canada AIDA AI Controls Mapping: Canadian AI Obligations to Enforcement Points

AIDA died with Bill C-27 on 6 January 2025, so Canadian AI governance runs on PIPEDA accountability, Quebec Law 25 section 12.1, OSFI model risk guidance, and the Treasury Board Directive on Automated Decision-Making. Each of those obligations attaches to a concrete moment in the AI request flow. This maps them onto the technical control and enforcement point that satisfies each, and names the evidence every control produces at the boundary where a prompt leaves your network.

Compliance & Regulationcomplianceai-governanceregulationpolicy-enforcementai-security
Read post →

Canada AIDA AI Compliance Checklist: Ten Items for Canadian AI Without a Federal AI Act

A working checklist for Canadian organizations running AI over personal information now that the Artificial Intelligence and Data Act has died with Bill C-27 and PIPEDA, Quebec Law 25, OSFI guidance and the Treasury Board Directive carry the load. Each item names the obligation, the concrete action, and the evidence it produces, so the list works as an audit-readiness pass. Ordered the way a Canadian privacy review moves: identity and accountability first, then consent and classification, then transfers, then automated decisions.

Compliance & Regulationcomplianceai-governanceregulationauditai-security
Read post →

CCPA CPRA AI Controls Mapping: California ADMT Obligations to Enforcement Points

California finalized its ADMT, risk assessment and cybersecurity audit regulations on 23 September 2025, effective 1 January 2026, with ADMT obligations attaching 1 April 2027. Each obligation lands on a concrete moment in the AI request flow. This maps the CCPA and CPRA duties that bite when a prompt carrying personal information reaches a model, from pre-use notice through opt-out, access and appeal, onto the control and enforcement point that satisfies each, and the evidence produced.

Compliance & Regulationcomplianceai-governanceregulationpolicy-enforcementai-security
Read post →

CCPA CPRA AI Audit Evidence: What the CPPA Expects Once the ADMT Rules Bite

California finalized its automated decisionmaking technology rules on 23 September 2025. The regulations took effect on 1 January 2026, ADMT obligations attach from 1 April 2027, and the first risk assessments go to the California Privacy Protection Agency by 1 April 2028. This walks the specific evidence a CCPA review asks for when a prompt carrying personal information reaches a model, from pre-use notice through opt-out and appeal, and names which system each artifact has to come from.

Compliance & Regulationcomplianceai-governanceregulationauditai-security
Read post →

China PIPL AI Audit Evidence: What the CAC Expects When a Prompt Leaves the Mainland

The Personal Information Protection Law has governed AI in China since 1 November 2021, layered since with the Interim Measures for Generative AI Services of 15 August 2023 and the AI content labelling rules of 1 September 2025. This walks the specific evidence a Cyberspace Administration of China review asks for when a prompt carrying personal information reaches a model, from the Article 24 automated-decision record to the Article 55 impact assessment and the cross-border thresholds, and names which system each artifact comes from.

Compliance & Regulationcomplianceai-governanceregulationauditai-security
Read post →

CCPA CPRA AI Compliance Checklist: Ten Items Before the April 2027 ADMT Deadline

A working checklist for businesses running AI over California consumer data ahead of the ADMT obligations that attach on 1 April 2027 under regulations approved 23 September 2025 and effective 1 January 2026. Each item names the duty, the concrete action, and the evidence it produces, so the list functions as an audit-readiness pass rather than a statement of intent. Ordered the way a CPPA review moves: scope and identity first, then notice and opt-out, then access, appeal and security.

Compliance & Regulationcomplianceai-governanceregulationauditai-security
Read post →

Cyera Buys Oasis Security for $1B: The Case for an Independent AI Control Plane

On 28 July 2026 Cyera agreed to buy Oasis Security for roughly $1 billion, about $700 million of it cash, weeks after raising $600 million at a $12 billion valuation. It is the second-largest cybersecurity deal of the year and the sixth platform absorption of an AI-agent or identity startup in twelve months. This reads the deal as category validation for identity-bound authorization of AI-agent activity, and sets out the RFP question a platform lead should ask about where that control sits.

Comparisons & Alternativesai-securityai-governanceidentity-and-authorizationagentic-aiarchitecture
Read post →

China PIPL AI Controls Mapping: PIPL Articles to AI Enforcement Points

The Personal Information Protection Law governs AI in China without amendment, because each obligation attaches to the handling of personal information whatever performs it. This maps the PIPL articles that bite when a prompt leaves your network, from the Article 24 automated-decision duties to the Article 55 impact assessment and the Articles 38 to 40 transfer rules with their March 2024 volume thresholds, onto the technical control and enforcement point that satisfies each, and the evidence every control produces.

Compliance & Regulationcomplianceai-governanceregulationpolicy-enforcementai-security
Read post →

China PIPL AI Compliance Checklist: Ten Items Before a Prompt Leaves the Mainland

A working checklist for organizations running AI over personal information under the Personal Information Protection Law, enforced by the Cyberspace Administration of China alongside the Interim Measures for Generative AI Services and the September 2025 content labelling rules. Each item names the article, the concrete action, and the evidence it produces, so the list works as an audit-readiness pass. Ordered the way a CAC review moves: identity and classification first, then consent, then transfers, then automated decisions.

Compliance & Regulationcomplianceai-governanceregulationauditai-security
Read post →