← All posts

Compliance & Regulation

305 posts on compliance & regulation.

China PIPL AI Controls Mapping: PIPL Articles to AI Enforcement Points

The Personal Information Protection Law governs AI in China without amendment, because each obligation attaches to the handling of personal information whatever performs it. This maps the PIPL articles that bite when a prompt leaves your network, from the Article 24 automated-decision duties to the Article 55 impact assessment and the Articles 38 to 40 transfer rules with their March 2024 volume thresholds, onto the technical control and enforcement point that satisfies each, and the evidence every control produces.

complianceai-governanceregulationpolicy-enforcementai-security
Read post →

China PIPL AI Compliance Checklist: Ten Items Before a Prompt Leaves the Mainland

A working checklist for organizations running AI over personal information under the Personal Information Protection Law, enforced by the Cyberspace Administration of China alongside the Interim Measures for Generative AI Services and the September 2025 content labelling rules. Each item names the article, the concrete action, and the evidence it produces, so the list works as an audit-readiness pass. Ordered the way a CAC review moves: identity and classification first, then consent, then transfers, then automated decisions.

complianceai-governanceregulationauditai-security
Read post →

COBIT AI Controls Mapping: 40 Objectives Against One HTTPS Request

COBIT 2019 spreads 40 governance and management objectives across five domains, and ISACA extended that structure to AI systems in a 2025 white paper without adding a single new objective. A handful of those objectives bite the moment a prompt leaves your network. This maps each one to the technical control that enforces it at the AI request boundary, the enforcement point where it fires, and the evidence artifact it produces for an internal audit review.

complianceai-governancepolicy-enforcementauditai-security
Read post →

COBIT AI Audit Evidence: What an ISACA-Aligned Review Asks You to Produce

COBIT 2019 carries 40 governance and management objectives across five domains, and ISACA published a 2025 white paper applying them to AI systems. An internal audit run against COBIT asks for operational evidence rather than policy documents. This walks the artifacts a COBIT-aligned review requests when a prompt carrying regulated data leaves your network, names the objective each artifact answers, and identifies which system has to produce it.

complianceai-governanceauditregulationai-security
Read post →

Connecticut SB 2 AI Audit Evidence: What the Attorney General Asks For Now That SB 5 Passed Instead

Senate Bill 2 passed the Connecticut Senate on 14 May 2025 and died in the House, the second session running. The law that actually arrived is Substitute Senate Bill 5, signed as Public Act 26-15 on 2 June 2026, alongside amendments to the Connecticut Data Privacy Act that took effect 1 July 2026 with profiling impact assessments from 1 August 2026. This walks the evidence artifacts a Connecticut review requests and names which system produces each one.

complianceai-governanceregulationauditai-security
Read post →

COBIT AI Compliance Checklist: Ten Items That Move an AI Process Past Capability Level 1

A working checklist for teams whose AI programme is being graded against COBIT 2019, the ISACA framework of 40 governance and management objectives that a 2025 white paper extended across the AI lifecycle. Each item names the objective, the concrete action, and the evidence artifact it produces, because COBIT grades process capability on documented work products. Ordered the way an internal audit walkthrough moves: identity and classification first, then risk, then change control, then assurance.

complianceai-governanceauditregulationai-security
Read post →

Connecticut SB 2 AI Controls Mapping: Public Act 26-15 and the Amended CTDPA at the Request Boundary

Connecticut SB 2 died in the House twice. The obligations arrived through Substitute SB 5, signed as Public Act 26-15 on 2 June 2026, and through Connecticut Data Privacy Act amendments effective 1 July 2026 that removed the word solely from the automated decision opt-out. This maps each live Connecticut AI obligation onto the technical control that enforces it at the request boundary, the enforcement point where it fires, and the evidence artifact it produces for the Attorney General.

complianceai-governanceregulationpolicy-enforcementai-security
Read post →

Connecticut SB 2 AI Compliance Checklist: Ten Items Before the October 2026 Deadline

A working checklist for organizations running AI over Connecticut consumer or employee data. Senate Bill 2 died in the House twice, so the live obligations sit in Public Act 26-15, signed 2 June 2026 with provisions from 1 October 2026, and in Connecticut Data Privacy Act amendments effective 1 July 2026 whose profiling impact assessment duty attached on 1 August 2026. Each item names the obligation, the concrete action, and the evidence it produces.

complianceai-governanceregulationauditai-security
Read post →

CSA AICM AI Controls Mapping: 18 Domains and Four Owners Against One HTTPS Request

The CSA AI Controls Matrix, released 10 July 2025, holds 243 control objectives across 18 security domains, each tagged with an owner drawn from the cloud provider, model provider, orchestrated service provider, and application provider. This maps the domains that bite when a prompt leaves your network onto the technical control that enforces each one at the AI request boundary, the enforcement point where it fires, and the evidence artifact a STAR for AI assessment reads.

complianceai-governancepolicy-enforcementcloud-securityai-security
Read post →

CSA AICM AI Audit Evidence: What a STAR for AI Assessment Asks You to Produce

The Cloud Security Alliance released the AI Controls Matrix on 10 July 2025 with 243 control objectives across 18 security domains, analyzed by control type, ownership, architectural layer, AI lifecycle stage, and threat category. STAR for AI assessments run against it. This walks the evidence artifacts an AICM assessment requests when a prompt carrying regulated data leaves your network, names the domain each artifact answers, and identifies which party in the shared-responsibility split has to produce it.

complianceai-governanceauditcloud-securityai-security
Read post →

CSA CCM AI Audit Evidence: Running 197 Cloud Controls Against AI Traffic

The Cloud Controls Matrix holds 197 control objectives across 17 domains and maps to roughly 40 standards, which is why so many enterprises already run their cloud assurance against it. AI traffic lands inside that scope without a single new control, because a prompt is an outbound API call carrying regulated data. This walks the CCM domains an AI deployment touches, the evidence each one asks for, and where existing CCM answers stop being true.

complianceai-governanceauditcloud-securityai-security
Read post →

CSA AICM AI Compliance Checklist: Ten Items Before a STAR for AI Self-Assessment

A working checklist for organizations preparing against the Cloud Security Alliance AI Controls Matrix, released 10 July 2025 with 243 control objectives across 18 security domains and an ownership dimension splitting each one between cloud, model, orchestration, and application providers. Each item names the domain, the concrete action, and the evidence it produces, so the list works as preparation for a STAR for AI Level 1 self-assessment rather than a reading exercise.

complianceai-governanceauditcloud-securityai-security
Read post →