← All posts

Compliance & Regulation

402 posts on compliance & regulation.

EU AI Act Conformity Assessment Bodies: Which Notified Bodies Will Sign Off Your High-Risk System

The EU AI Act requires high-risk AI systems to undergo a conformity assessment before being placed on the market. For some categories, the provider self-assesses. For others, the provider has to engage a notified body that the member state has designated under Article 31. With August 2, 2026 thirty-two days away, providers need a working understanding of which Annex III categories trigger third-party conformity assessment, how the notified body designation process works, and what the assessment record looks like when it lands in a market surveillance investigation.

eu-ai-actconformity-assessmentnotified-bodiescompliancehigh-risk-airegulation
Read post →

EU AI Act Conformity Assessment: The Two Routes, Who Performs Each One, and What the Audit File Has to Contain

A high-risk AI system cannot be placed on the Union market without a conformity assessment. Article 43 allows two routes: an internal control procedure based on Annex VI, and a third-party procedure involving a notified body and Annex VII. The route depends on the system category. The audit file must contain the technical documentation listed in Annex IV, including the system architecture, the risk management process, the data governance approach, and the record-keeping system. Most enterprise deployers have not yet built the record-keeping side.

eu-ai-actcomplianceai-governanceauditregulationhigh-risk-ai
Read post →

EU AI Act August 2, 2026 Deadline: The Operational Cutover for High-Risk AI Systems

August 2, 2026 is when the EU AI Act high-risk system obligations bind. The deadline applies to credit scoring, employment screening, education access, biometric identification, and the rest of the Annex III list. The operational cutover requires logging, identity binding on the AI request path, conformity assessment evidence, and the per-decision record under Article 12. This piece walks through the cutover, what the obligation expects, and what the operational stack has to produce.

eu-ai-actaugust-2-2026compliancehigh-risk-aiarticle-12
Read post →

EU AI Act August 2, 2026 Readiness Checklist: The 32-Day Operational Sweep

On August 2, 2026, the EU AI Act high-risk system obligations take effect. Providers and deployers operating in the EU have 32 days from today to close the gap between the regulation as written and the operational evidence the supervisory authorities will ask for. This checklist walks the eight artifacts a high-risk deployer needs in production before August 2: the inventory, the classification, the Article 11 documentation, the Article 12 logging architecture, the Article 14 human oversight record, the Article 19 retention plan, the Article 26 deployer obligations, and the Article 73 incident reporting workflow.

eu-ai-actcompliancehigh-risk-airegulationauditai-governance
Read post →

The Commission adopted its Article 50 guidelines on July 20: who discloses, who marks, and what you have to be able to prove

The European Commission adopted its final guidelines on the Article 50 transparency obligations on July 20, 2026, thirteen days before those obligations start to apply on August 2. The guidelines set out scope, definitions, and exceptions, and they split the duties actor by actor: providers carry the interaction notice and the machine-readable marking of synthetic content, deployers carry emotion-recognition notice and deepfake disclosure. Generative systems already on the market get until December 2, 2026 for machine-readable marking. This walks the split obligation by obligation and separates the parts an AI policy gateway produces evidence for from the parts it never touches.

eu-ai-actcomplianceregulationai-governanceai-complianceaudit
Read post →

EU AI Act Compliance: What the Regulation Requires from Enterprise AI Architecture

The EU AI Act enters force in stages from February 2025 through August 2027. The August 2, 2026 deadline brings high-risk system obligations into effect for most enterprise AI deployments in the EU market. Penalties under Article 99 reach €35 million or 7% of global annual turnover. This pillar walks through what the Act actually mandates, where most architectures fall short, and the infrastructure pattern that satisfies the obligations at scale.

eu-ai-actcomplianceai-governanceauditregulationhigh-risk-ai
Read post →

AI Governance Tools Comparison: Where Each Category Sits and Which Obligation It Closes

AI governance tools comparison work usually treats the category as a flat list of competitors. The 2026 reality is that the category covers four very different product shapes that sit at different layers and close different obligations under EU AI Act Article 12, Fannie Mae LL-2026-04, NIST AI RMF, and ISO 42001. This piece compares the four shapes against each obligation and shows the combination most regulated buyers actually need.

ai-governanceai-governance-toolscomplianceeu-ai-actvendor-evaluationprocurement
Read post →

AI Governance Maturity Model: The Five Stages and Where Most Enterprises Actually Sit

AI governance maturity models tend to read as aspirational ladders that everyone climbs eventually. The version that matches what regulators ask for in 2026 has five concrete stages defined by the per-decision evidence the deployer can produce at each level. This piece walks through the five stages, where each stage sits against EU AI Act Article 12 and Fannie Mae LL-2026-04 obligations, and the architectural control that moves an organization to the next stage.

ai-governanceai-governance-maturity-modelcomplianceeu-ai-actrisk-managementaudit
Read post →

AI Governance Framework: The Operational Layers Between Policy Documents and the Audit Record

An AI governance framework that survives an audit has three operational layers: a policy layer that names what the program will and will not do, an enforcement layer that binds the policy to production traffic, and a record layer that produces the per-decision evidence. This piece walks through each layer, what artifacts each one produces, and how the layers map to EU AI Act Article 12, NIST AI RMF, and ISO 42001.

ai-governance-frameworkai-governanceeu-ai-actnist-ai-rmfiso-42001
Read post →

AI Governance Failure: What the Headline Incidents Have in Common and Where the Architecture Fails

AI governance failures cluster around the same architectural defects in incident after incident: identity unbound at the request layer, audit logs written by the application under audit, shadow AI traffic outside the inspection boundary, and vendor AI usage the deployer never sees. This piece walks through the recurring failure pattern, the recent incident record, and the architectural control that closes each defect before the next breach gets reported.

ai-governanceai-governance-failureincident-responsecomplianceshadow-aiaudit
Read post →

AI Governance Challenges: The Seven Failures That Show Up in the First Regulator Review

AI governance challenges show up in a specific order during the first EU AI Act, NIST AI RMF, and Fannie Mae LL-2026-04 review. The seven failure modes cluster around identity binding, per-decision audit, shadow AI exposure, vendor AI usage, policy version drift, model registry gaps, and disclosure obligations. This piece walks each failure mode through the regulatory question that surfaces it and the architectural control that closes it.

ai-governanceai-governance-challengescomplianceeu-ai-actrisk-managementaudit
Read post →

AI Governance Tools: What the Category Has To Cover and Where Most Products Stop

The AI governance tools category bundles four very different product shapes: model registries, policy authoring platforms, posture and inventory scanners, and runtime enforcement layers. Each shape covers a different obligation under the EU AI Act, NIST AI RMF, ISO 42001, and Fannie Mae LL-2026-04. This piece walks through what each shape does, where each one stops, and the runtime gap most buyers discover after the procurement decision.

ai-governanceai-governance-toolscomplianceeu-ai-actnist-ai-rmfiso-42001
Read post →