← All posts

Compliance & Regulation

305 posts on compliance & regulation.

California AI Law in 2026: Which Statutes Bind an Enterprise Deployer, and When

A compliance owner tracking California AI law in 2026 has five statutes to sort: SB 1001 bot disclosure, AB 2013 training-data transparency, SB 942 (delayed to August 2, 2026 by AB 853), the CPPA automated-decisionmaking rules under the CCPA, and SB 53 frontier-model safety. This piece separates the obligations that bind you as a deployer from the ones that bind model developers, with effective dates and the primary sources for each.

compliancecalifornia-ai-lawregulationautomated-decision-makingaudit-trail
Read post →

Claude Text Watermarks Leave a Deployer Evidence Gap

Anthropic says Claude models launched in the EU on or after August 2, 2026 carry machine-readable marks. That provider capability is useful, but a deployer’s evidence needs to show which identity received which model output under which disclosure policy at a specific time.

eu-ai-actai-complianceregulationauditai-governance
Read post →

ISO 42001 Audit Evidence: What an AI Gateway Record Proves for Your AIMS

ISO 42001 certifies an AI management system, and a certification audit tests whether your controls operate and asks for evidence. Most AIMS documentation describes policy for AI use without a record that a given model call was governed. This piece maps AI gateway records onto the ISO 42001 controls an auditor samples, so operational control over AI use produces artifacts instead of assertions.

iso-42001'compliance''ai-audit''evidence''aims'
Read post →

AI Audit Log Retention Requirements: How Long to Keep Model Call Records

Different regimes impose different retention obligations on AI records, and the safe default is the longest applicable period. This piece walks the retention expectations behind EU AI Act record-keeping, SOC 2 observation windows, and financial-sector rules, then shows what a per-decision model call record has to carry to still be useful years after the request it documents.

ai-audit'compliance''audit-logs''eu-ai-act''retention'
Read post →

AI Agent Identity Governance: Setting Policy for Which Agents Exist and What They May Do

Agent identity governance is the policy layer that decides which AI agents may exist, what each is scoped to touch, and how an organization proves that oversight to an auditor. This walks through the lifecycle (provisioning, scoping, deprovisioning), the gap between policy on paper and enforcement at the request line, and how the discipline maps to the NIST three-pillar model, EU AI Act Article 12, and ISO/IEC 42001.

ai-governanceidentity-and-authorizationagentic-ainisteu-ai-actcomplianceaudit
Read post →

AI Incident Response Automation: Where Machine-Speed Containment Actually Belongs

Automating incident response for AI traffic means being precise about which part of the response can run without a human and which cannot. Google Mandiant M-Trends 2026 puts median attack handoff at 22 seconds, faster than any analyst can triage. This piece separates the containment decision (which belongs inline, at the AI request boundary, where a policy violation can be blocked before it executes) from the investigation and recovery work that automation can accelerate but not replace, and shows how a structured audit record turns an AI incident into something an automated pipeline can act on.

ai-securityinline-enforcementforensic-auditauditagentic-aicompliancepolicy-enforcement
Read post →

AI Agent Incident Response: The Evidence You Need When an Agent Is in the Blast Radius

When an AI agent is part of a security incident, the responding team needs to answer three questions per action: which identity authorized the call, what policy applied, and what the agent asked the model. Google Mandiant M-Trends 2026 puts the median handoff from initial access to a secondary threat group at 22 seconds, a tempo that turns after-the-fact log review into forensic archaeology. This piece defines the evidence an incident response team needs from AI traffic, where most teams are blind, and how EU AI Act Article 12 raises the bar on the record.

agentic-aiai-securityforensic-auditauditidentity-and-authorizationcomplianceeu-ai-act
Read post →

ISO 42001 Certification: The Audit Stages, the Annex A Controls, and the AI Traffic Evidence Most Teams Cannot Produce

ISO/IEC 42001:2023 is the first management system standard for AI, and certification against it runs through a Stage 1 documentation review and a Stage 2 implementation audit by an accredited certification body, followed by a three-year cycle with annual surveillance. The auditor asks for evidence that the Annex A controls actually operate. For the controls that govern AI inference traffic, access, and logging, most teams cannot produce a record tied to who sent what to which model. This piece walks the certification path and the evidence gap on AI request traffic.

iso-42001ai-governancecomplianceai-audit-loggingidentity-and-authorizationaudit-and-evidenceai-management-system
Read post →

Australia Privacy Act AI Compliance Checklist: Ten Items Before a Prompt Carries Personal Information

A working checklist for Australian organisations running AI over personal information under the Privacy Act 1988 and the Australian Privacy Principles, with the automated decision-making transparency obligations landing 10 December 2026. Each item names the obligation, the concrete action, and the evidence to produce, so the list doubles as an audit-readiness pass rather than a set of intentions. Ordered by what an OAIC inquiry reaches for first.

complianceai-governanceregulationauditai-security
Read post →

Australia Privacy Act AI Audit Evidence: What the OAIC Asks For and Where Each Artifact Comes From

Australia has no dedicated AI Act. AI that processes personal information is governed under the Privacy Act 1988 and the Australian Privacy Principles, enforced by the OAIC, with new automated decision-making transparency obligations from the Privacy and Other Legislation Amendment Act 2024 taking effect 10 December 2026. When the OAIC opens an inquiry, it asks for evidence, not intent. This walks the specific artifacts an AI privacy review produces and marks which system each one has to come from.

complianceai-governanceregulationauditai-security
Read post →

Brazil LGPD AI Audit Evidence: What the ANPD Expects When a Prompt Carries Personal Data

Brazil governs AI through the LGPD (Law 13.709/2018) while its dedicated AI bill, PL 2338/2023, moves through the Chamber of Deputies after the Senate approved it on 10 December 2024. The ANPD enforces the LGPD, and its 2025 technical note on automated decisions signals where scrutiny is heading. This walks the specific evidence an LGPD review of an AI system expects, from Article 20 automated decisions to Articles 33 to 36 international transfers, and marks which system each artifact has to come from.

complianceai-governanceregulationauditai-security
Read post →

Australia Privacy Act AI Controls Mapping: Australian Privacy Principles to Enforcement Points

The Australian Privacy Principles were written for personal information handling in general, and they apply to AI traffic without a translation layer. This maps the APPs that bite when a prompt carrying personal information leaves your network, plus the automated decision-making obligations effective 10 December 2026, to the specific technical control and enforcement point that satisfies each one. The mapping is deliberately concrete: obligation, where it applies in the request flow, the control, and the evidence the control produces.

complianceai-governanceregulationpolicy-enforcementai-security
Read post →