← All posts

Compliance & Regulation

305 posts on compliance & regulation.

Brazil LGPD AI Compliance Checklist: Ten Items Before a Prompt Carries Personal Data

A working checklist for organisations running AI over personal data under the LGPD (Law 13.709/2018), enforced by the ANPD, while PL 2338/2023 advances through the Chamber of Deputies. Each item names the article, the concrete action, and the evidence to produce, so the list functions as an audit-readiness pass rather than a statement of principles. Ordered the way an ANPD review moves: identity and records, then legal basis, then transfers, then automated decisions.

complianceai-governanceregulationauditai-security
Read post →

California SB 942 AI Audit Evidence: What a Deployer of Covered Generative Systems Has to Show

The California AI Transparency Act (SB 942) takes effect 2 August 2026 after AB 853 delayed it from January, and it puts content-provenance obligations on covered providers of generative image, video, and audio systems with more than one million monthly users. Watermark generation sits at the model layer, outside an HTTP proxy. The evidence an enterprise deploying or licensing those systems has to produce sits in the traffic. This walks the audit artifacts that are actually visible at the request boundary and names what is not.

complianceai-governanceregulationauditai-security
Read post →

Brazil LGPD AI Controls Mapping: LGPD Articles to Enforcement Points

The LGPD (Law 13.709/2018) governs AI in Brazil today, and each of its articles attaches to a concrete moment in the AI request flow. This maps the LGPD obligations that bite when a prompt carrying personal data leaves your network, from the Article 6 accountability principle to Article 20 automated decisions and the Articles 33 to 36 transfer rules, onto the technical control and enforcement point that satisfies each. The mapping stays concrete: article, where it applies, the control, and the evidence produced.

complianceai-governanceregulationpolicy-enforcementai-security
Read post →

California SB 942 AI Controls Mapping: Obligations to What a Proxy Can and Cannot Enforce

The California AI Transparency Act (SB 942) takes effect 2 August 2026 after AB 853 delayed it. Its obligations split cleanly into two groups: content-provenance duties that live at the model and generation layer, and deployer-side evidence duties that live in the traffic. This maps each SB 942 obligation to the control that satisfies it, and marks honestly which ones an HTTP enforcement point can produce evidence for and which belong to the covered provider. Precision on that boundary is the point.

complianceai-governanceregulationpolicy-enforcementai-security
Read post →

California SB 942 AI Compliance Checklist: Ten Items Split by Who Actually Owns Each One

A working checklist for the California AI Transparency Act (SB 942), operative 2 August 2026 after AB 853 delayed it. The list is split deliberately: the provenance and detection items a covered provider owns at the generation layer, and the evidence and verification items a deployer or licensee owns in the traffic. Each item names the action, who owns it, and the evidence to produce, so nobody assumes the vendor covered their side.

complianceai-governanceregulationauditai-security
Read post →

Canada AIDA AI Audit Evidence: What an Audit Asks For Now That AIDA Never Passed

The Artificial Intelligence and Data Act died with Bill C-27 when Parliament prorogued on 6 January 2025, and it has not been reintroduced. Canadian AI programmes still face audits, run under PIPEDA accountability, Quebec Law 25 section 12.1, OSFI guidance, and the Treasury Board Directive on Automated Decision-Making. This walks the specific evidence artifacts those reviews ask for when a prompt carrying personal information leaves your network, and names which system each artifact has to come from.

complianceai-governanceregulationauditai-security
Read post →

Canada AIDA AI Controls Mapping: Canadian AI Obligations to Enforcement Points

AIDA died with Bill C-27 on 6 January 2025, so Canadian AI governance runs on PIPEDA accountability, Quebec Law 25 section 12.1, OSFI model risk guidance, and the Treasury Board Directive on Automated Decision-Making. Each of those obligations attaches to a concrete moment in the AI request flow. This maps them onto the technical control and enforcement point that satisfies each, and names the evidence every control produces at the boundary where a prompt leaves your network.

complianceai-governanceregulationpolicy-enforcementai-security
Read post →

Canada AIDA AI Compliance Checklist: Ten Items for Canadian AI Without a Federal AI Act

A working checklist for Canadian organizations running AI over personal information now that the Artificial Intelligence and Data Act has died with Bill C-27 and PIPEDA, Quebec Law 25, OSFI guidance and the Treasury Board Directive carry the load. Each item names the obligation, the concrete action, and the evidence it produces, so the list works as an audit-readiness pass. Ordered the way a Canadian privacy review moves: identity and accountability first, then consent and classification, then transfers, then automated decisions.

complianceai-governanceregulationauditai-security
Read post →

CCPA CPRA AI Controls Mapping: California ADMT Obligations to Enforcement Points

California finalized its ADMT, risk assessment and cybersecurity audit regulations on 23 September 2025, effective 1 January 2026, with ADMT obligations attaching 1 April 2027. Each obligation lands on a concrete moment in the AI request flow. This maps the CCPA and CPRA duties that bite when a prompt carrying personal information reaches a model, from pre-use notice through opt-out, access and appeal, onto the control and enforcement point that satisfies each, and the evidence produced.

complianceai-governanceregulationpolicy-enforcementai-security
Read post →

CCPA CPRA AI Audit Evidence: What the CPPA Expects Once the ADMT Rules Bite

California finalized its automated decisionmaking technology rules on 23 September 2025. The regulations took effect on 1 January 2026, ADMT obligations attach from 1 April 2027, and the first risk assessments go to the California Privacy Protection Agency by 1 April 2028. This walks the specific evidence a CCPA review asks for when a prompt carrying personal information reaches a model, from pre-use notice through opt-out and appeal, and names which system each artifact has to come from.

complianceai-governanceregulationauditai-security
Read post →

China PIPL AI Audit Evidence: What the CAC Expects When a Prompt Leaves the Mainland

The Personal Information Protection Law has governed AI in China since 1 November 2021, layered since with the Interim Measures for Generative AI Services of 15 August 2023 and the AI content labelling rules of 1 September 2025. This walks the specific evidence a Cyberspace Administration of China review asks for when a prompt carrying personal information reaches a model, from the Article 24 automated-decision record to the Article 55 impact assessment and the cross-border thresholds, and names which system each artifact comes from.

complianceai-governanceregulationauditai-security
Read post →

CCPA CPRA AI Compliance Checklist: Ten Items Before the April 2027 ADMT Deadline

A working checklist for businesses running AI over California consumer data ahead of the ADMT obligations that attach on 1 April 2027 under regulations approved 23 September 2025 and effective 1 January 2026. Each item names the duty, the concrete action, and the evidence it produces, so the list functions as an audit-readiness pass rather than a statement of intent. Ordered the way a CPPA review moves: scope and identity first, then notice and opt-out, then access, appeal and security.

complianceai-governanceregulationauditai-security
Read post →