← All posts

Compliance & Regulation

402 posts on compliance & regulation.

Fannie Mae LL-2026-04: the first sector-specific AI governance mandate for lenders

Fannie Mae Lender Letter LL-2026-04 was issued April 8, 2026 and takes effect August 8, 2026. It is the first sector-specific AI governance mandate in US mortgage lending. The Letter requires lenders to inventory AI usage, document data classification, attach identity context, and produce audit records for AI-influenced credit decisions. Freddie Mac Section 1302.8 has been enforced since March 3, 2026. This piece walks through the requirements, what they mean for the lender stack, and the architecture that satisfies them.

fannie-maemortgageai-governancelendingcomplianceaudit
Read post →

EU AI Act Systemic-Risk Models: How the 10^25 FLOPs Threshold Triggers Article 55 Obligations

The EU AI Act treats a subset of general-purpose AI models as systemic-risk under Article 51, with the principal trigger set at 10^25 FLOPs of training compute. Models in that bucket inherit additional Article 55 obligations on model evaluation, systemic-risk assessment, serious-incident reporting, and cybersecurity. This article walks through the threshold mechanics, the Commission designation pathway, and the second-order obligations that flow to enterprise deployers integrating a systemic-risk model.

eu-ai-actsystemic-riskcompliancegpairegulationfoundation-models
Read post →

EU AI Act Substantial Modification: When an Update Turns Your Deployer Into a Provider

Article 25 of the EU AI Act says a deployer who substantially modifies a high-risk AI system becomes a provider for that modified system. The provider obligations are heavier than the deployer obligations. Most enterprise teams discover this rule after they have fine-tuned a model, added a retrieval layer, or changed the intended purpose. This piece walks through what the regulation defines as substantial modification, the three updates most likely to trigger it, and the records you need to track every change at the AI request boundary.

eu-ai-actcomplianceauditregulationprovider-obligations
Read post →

EU AI Act Post-Market Monitoring: Article 72 Obligations and the Plan That Survives an Audit

EU AI Act Article 72 requires providers of high-risk AI systems to establish and document a post-market monitoring system that actively and systematically collects, documents, and analyzes data on the performance of the system throughout its lifetime. The monitoring system must be proportionate to the nature of the AI technologies and the risks, and it must allow the provider to evaluate continuous compliance with the requirements of Chapter III, Section 2 of the regulation. With the August 2, 2026 high-risk enforcement date 34 days away, providers and deployers need a clear read on what the monitoring plan must contain, what data feeds it, and what artifacts an auditor expects to see.

eu-ai-actcompliancepost-market-monitoringhigh-risk-airegulationarticle-72
Read post →

EU AI Act GPAI Code of Practice: What Foundation Model Providers Have to Sign Before August 2

The GPAI Code of Practice is the EU Commission instrument that operationalizes the August 2, 2026 General-Purpose AI obligations from the EU AI Act. Providers that sign the Code get a presumption of compliance with Articles 53 through 56. Providers that do not sign must demonstrate equivalent compliance by other means. This article walks through the Code chapters, the August 2 enforcement consequences, and what enterprise deployers downstream of a non-signatory provider need to add to their own control stack.

eu-ai-actgpaicompliancefoundation-modelsregulationai-governance
Read post →

EU AI Act General-Purpose AI: Article 53 Obligations, the August 2 Deadline, and the Deployer Consequences

The EU AI Act separates general-purpose AI (GPAI) rules from the high-risk system rules. GPAI obligations under Articles 53 through 55 sit with the model providers (OpenAI, Anthropic, Google, Mistral, Meta) and take effect August 2, 2026. Downstream deployers absorb second-order obligations through the technical documentation and evaluation records upstream providers must supply. This piece walks through what Article 53 requires from GPAI providers, what the systemic-risk threshold under Article 55 changes for the frontier labs, and the practical inspection-layer records a deployer running GPT-5, Claude 4, or Gemini 3 needs to keep against Articles 12, 13, and 26 in parallel.

eu-ai-actgpaigeneral-purpose-aiarticle-53article-55compliance
Read post →

EU AI Act FRIA Templates for Deployers: What the Article 27 Assessment Actually Has to Contain

Article 27 of the EU AI Act requires a Fundamental Rights Impact Assessment from certain deployers of high-risk AI systems before first use. The FRIA must cover the deployment process, the time period and frequency of use, the categories of natural persons affected, the specific risks of harm, the human oversight measures, and the measures to take if those risks materialize. The August 2, 2026 enforcement date means deployers of in-scope systems need a completed FRIA in hand at that point. This article walks through what Article 27 actually requires, which deployers are in scope, and the section-by-section structure a defensible FRIA needs.

eu-ai-actcomplianceai-governanceregulationfundamental-rightsfria
Read post →

EU AI Act EU Database Registration: Article 49 Obligations for High-Risk Systems

EU AI Act Article 49 requires providers of most high-risk AI systems to register the system in the EU database for high-risk AI systems before placing it on the EU market or putting it into service. Article 49(2) creates a parallel obligation for public-authority deployers and certain EU institution deployers to register the systems they use. The database is maintained by the Commission and is publicly accessible for the information that is not commercially sensitive. With the August 2, 2026 high-risk enforcement date 34 days away, providers and the in-scope deployers need a clear read on what gets registered, who registers it, and what the registration record contains.

eu-ai-actcompliancedatabase-registrationhigh-risk-airegulationarticle-49
Read post →

EU AI Act Enforcement Began with Live Complaint Channels

The European Commission began enforcing new AI Act rules on August 2, 2026 and opened complaint, whistleblower, and downstream-provider channels. A compliance owner now needs evidence tied to a named interaction, user, policy, and date when an authority asks what happened.

eu-ai-actai-complianceregulationauditai-governance
Read post →

Compliance After the Act: The EU AI Act Mindset Shift From Documentation to Per-Decision Evidence

EU AI Act Article 12 takes effect August 2, 2026 and changes what regulators ask of high-risk AI systems. Compliance teams that came from GDPR are familiar with management-level documentation regimes. The Act asks for operational-level per-decision evidence. This piece walks through the four mindset shifts a security and compliance organization has to make: from policy documents to live audit records, from quarterly reviews to per-request decisions, from third-party attestation to first-party evidence, and from boundary controls to per-route enforcement.

eu-ai-actarticle-12complianceaudit-logshigh-risk-aigovernance
Read post →

AI vendor liability: you own it, the vendor will not

Microsoft, SAP, Oracle, Salesforce, ServiceNow, and Workday all sell AI agents under enterprise contracts. When The Register asked who is liable for the decisions those agents make, Microsoft and SAP declined to comment and the other four did not respond. The contract language already places the risk on the deployer. This piece walks through what the regulators say, what the contracts say, and what a deployer must produce on its own to discharge the obligation.

ai-vendor-liabilityeu-ai-actcomplianceauditai-governance
Read post →

AI Accountability Frameworks: What NIST, the EU AI Act, and ISO 42001 Require You to Prove

The NIST AI RMF GOVERN function, EU AI Act Articles 12 and 26, ISO/IEC 42001, and OMB agency guidance all reduce accountability to one operational test: who authorized which AI action, and can you produce the record that proves it. This is a comparison of what each framework demands, and where a policy gateway supplies the evidence layer without standing in for the governance program itself.

ai-governancenist-ai-rmfeu-ai-actiso-42001accountabilitycomplianceaudit
Read post →