← All posts

Compliance & Regulation

430 posts on compliance & regulation.

ISO 42001 Annex A Controls: The 38 AI Management Controls and Where Each One Lands in the Deployment

ISO 42001 Annex A lists 38 controls across nine areas (A.2 through A.10) that an organization implementing an AI Management System (AIMS) has to consider. Numbering starts at .2 because the .1 position holds each control objective, and A.6 splits into A.6.1 and A.6.2 for nine lifecycle controls. The Statement of Applicability records implementation status, exclusions with justification, and incomplete controls with target dates. This guide maps all 38 controls to deployment layers and evidence artifacts, explains ISO/IEC 42006:2025, and sets out why an ISO 42001 certificate grants no EU AI Act Article 17 presumption.

iso-42001annex-aaimsai-management-systemai-compliancecertification
Read post →

Is Codex HIPAA Compliant? Local, API, and Cloud Eligibility

Codex has a conditional HIPAA answer. Codex Local can transmit PHI to OpenAI under a BAA when it is signed into an eligible ChatGPT workspace. An API route requires BAA coverage for API Services with Modified Retention. OpenAI excludes Codex Cloud from BAA coverage, and its BAA also excludes local client execution and third-party services accessed by Codex. Approval therefore belongs to a named route, account, configuration, and task rather than the Codex brand.

hipaaai-complianceai-securitypolicy-enforcementauditarchitecture
Read post →

Google SAIF: Turn the Secure AI Framework Into Control Ownership

Google SAIF maps AI security risks and controls across four component areas: data, infrastructure, model, and application. A useful implementation turns that map into a versioned ownership record for each relevant risk, with an enforcement point, acceptance test, evidence location, and review trigger. This guide explains the framework, the artifact security teams should build, and the limited request-boundary slice that DeepInspect can support.

ai-securityai-governanceai-compliancearchitecturepolicy-enforcementaudit
Read post →

GitHub Copilot GDPR: Map Controller, Processor, and Model Routes

A GitHub Copilot GDPR review should assign controller and processor roles by processing activity, identify model and subprocessor routes, connect each purpose to its data categories and retention terms, and test what actually leaves developer tools. GitHub may act as processor for most organization-account activity and as controller for specified activities, so one label for the whole service is unreliable.

github-copilotgdprdata-protectionvendor-riskai-governanceaudit-evidence
Read post →

Federal AI Preemption: What Executive Order 14365 Actually Does

Executive Order 14365 creates a federal strategy for challenging selected state AI laws, evaluating state measures, attaching conditions to some funding, and developing federal reporting and legislative proposals. It does not erase state law by itself. Compliance teams need a versioned obligation register that separates enacted duties from litigation, agency proceedings, funding actions, and proposed legislation.

ai-governanceai-regulationstate-ai-lawsfederal-policycomplianceaudit-evidence
Read post →

AI Tabletop Exercise: Turn the CISA Scenario Into a Control Test

A useful AI tabletop exercise makes response teams prove detection, containment, evidence capture, external sharing, continuity, and restart decisions across one escalating scenario. This guide turns the CISA JCDC exercise into an enterprise test with observable results while keeping model traffic controls separate from endpoint, supply-chain, and crisis-management duties.

ai-governanceincident-responsecybersecuritycisaai-agentsaudit-evidence
Read post →

India AI Governance Guidelines Need Control Owners, Tests, and Evidence

India's AI governance work points toward coordinated oversight across ministries rather than one isolated technical rulebook. Enterprises can prepare by mapping each AI use case to a named owner, a measurable control, an evidence record, and a review trigger. The useful output is an operating file that connects policy to the system's actual data flows and decisions.

ai-governanceai-complianceregulationauditpolicy-enforcementarchitecture
Read post →

Singapore AI Verify: Turn the Testing Framework Into Evidence

Singapore AI Verify provides a testing framework for assessing responsible implementation across 11 AI governance principles. The AI Verify Foundation structures the framework around principles and outcomes, with processes and evidence, with coverage for traditional and generative AI. Enterprise teams can use it to assign owners and collect reviewable artifacts, while preserving the distinction between a framework assessment and a legal compliance decision. Runtime control evidence remains distinct from both.

ai-governanceai-complianceai-securityauditpolicy-enforcementregulation
Read post →

Is Fireflies AI HIPAA Compliant? Three Conditions Decide

Is Fireflies AI HIPAA compliant? Fireflies says HIPAA status requires an Enterprise plan, enabled Private Storage, and a signed Business Associate Agreement. The status disables if any one of those conditions is removed or downgraded. Healthcare teams still need to verify the covered workspace, meeting routes, access, integrations, retention, and operating evidence before protected health information enters the service.

hipaaai-complianceai-securityauditdata-protectionpolicy-enforcement
Read post →

FTC AI Enforcement: What Operation AI Comply Puts on Notice

FTC AI enforcement under Operation AI Comply targeted claims about legal services, consumer reviews, and automated business opportunities. The cases show a practical rule for enterprise AI claims: preserve evidence for the promised capability, the test method, the deployed version, and the review path before marketing or procurement repeats the claim. This guide turns the FTC examples into a claim-to-evidence control.

ai-governanceai-complianceai-securityauditpolicy-enforcementregulation
Read post →

EU AI Act Digital Omnibus: The New High-Risk AI Timeline

Regulation (EU) 2026/1744, the Digital Omnibus on AI, changed when key high-risk AI provisions apply. Annex III systems now move to December 2, 2027, while product-linked Annex I systems move to August 2, 2028. The amendment does not pause the entire EU AI Act. Enterprise teams need a classification register that separates system category and operator role from the applicable article and date, with an owner and technical evidence.

ai-governanceai-securityeu-ai-actpolicy-enforcementregulationrisk-management
Read post →

America's AI Action Plan: Federal Signals for Enterprise AI Security

America's AI Action Plan is a federal policy agenda built around innovation, infrastructure, and international security. It directs agencies toward procurement changes, AI security guidance, incident-response work, and full-stack export programs. Enterprise teams should track those outputs without mistaking the plan for a private-sector compliance rule. This guide turns the federal actions into a review register with owners, triggers, and evidence.

ai-governanceai-securitycybersecuritynistpolicy-enforcementregulation
Read post →