305 posts on compliance & regulation.
ISO/IEC 23894:2023 creates concrete governance work for enterprise AI: identify the processing, bind each request to identity and purpose, enforce data and model policy before transmission, preserve request-level evidence, and test deletion, incident, and exception paths. This guide turns the requirement into controls an assessor can inspect.
ISO/IEC 27701:2025 creates concrete governance work for enterprise AI: identify the processing, bind each request to identity and purpose, enforce data and model policy before transmission, preserve request-level evidence, and test deletion, incident, and exception paths. This guide turns the requirement into controls an assessor can inspect.
ISO/IEC 23894:2023 creates concrete governance work for enterprise AI: identify the processing, bind each request to identity and purpose, enforce data and model policy before transmission, preserve request-level evidence, and test deletion, incident, and exception paths. This guide turns the requirement into controls an assessor can inspect.
ISO/IEC 27701:2025 sets requirements for privacy information management by PII controllers and processors. This mapping connects AI inventory, identity, purpose, classification, processor routing, retention, incident response, and control testing to concrete owners and request-level evidence.
ISO/IEC 27701:2025 turns privacy management into operational work for AI systems. This checklist covers inventory, identity, purpose, prompt classification, processor routes, retention, incident response, testing, and request-level evidence, with a clear boundary between privacy governance and HTTP AI enforcement.
ISO/IEC 5338:2023 extends system and software life cycle processes for machine-learning and heuristic AI systems. This checklist turns its agreement, organizational, technical-management, and technical process groups into inspectable work: scope the system, control suppliers and changes, engineer data, validate continuously, preserve runtime evidence, maintain the system, and prove disposal.
ISO/IEC 5338:2023 defines AI system life cycle processes covering acquisition, organizational support, technical management, engineering, operation, maintenance, and disposal. This guide shows how to build an evidence chain across those processes, connect design decisions to production AI requests, and keep the distinction between process conformance and ISO/IEC 42001 management-system certification clear.
Japan's APPI turns enterprise AI traffic into a privacy evidence problem when prompts, responses, or retrieved context contain personal information. Audit evidence must connect the stated purpose, caller, data category, model destination, transfer basis, policy decision, and retention action for each relevant request. This guide separates records the Act expressly requires from operational proof that supports a PPC inquiry.
ISO/IEC 5338:2023 organizes AI system life cycle work into agreement, organizational project-enabling, technical management, and technical processes. This mapping connects those process families to control objectives, owners, implementations, and evidence, while marking the boundary between model and data lifecycle controls and the HTTP request controls DeepInspect can enforce.
A Japan APPI AI controls mapping should connect each applicable statutory duty to an owner, an enforcement point, a test, and retained evidence. This mapping covers purpose limitation, special care-required information, security measures, employee and processor supervision, domestic and foreign provision, incident response, and individual rights, with applicability nuances for entrusted LLM providers.
This Japan APPI AI compliance checklist converts purpose limitation, special care-required information, security measures, entrusted-person supervision, foreign transfers, incident response, and individual rights into testable work at the LLM request boundary. Each item names the evidence an owner should retain and flags the applicability decisions that depend on the provider contract and processing route.
South Korea''s AI Basic Act and its Enforcement Decree took effect on 22 January 2026, with a one-year grace period on administrative fines running to 22 January 2027. This walks the evidence artifacts an operator in the high-impact category has to hand over when the Ministry of Science and ICT inspects: the classification record, the meaningful-explanation record, the prior-notification record, the generative AI labelling record, and the human-supervision record. Each artifact is named alongside the point in the request path that produces it.