← All posts

Compliance & Regulation

305 posts on compliance & regulation.

Korea AI Basic Act AI Controls Mapping: Operator Duties Against One HTTPS Request

South Korea''s AI Basic Act places its obligations on the operator rather than the model, which means most of them resolve to a technical control in the request path. This maps the high-impact duties, the generative AI transparency duties, and the inspection-response duty onto the enforcement point that satisfies each one, names the evidence produced, and marks the two duties that sit outside the AI request boundary and require organisational work instead.

complianceai-governancepolicy-enforcementregulationai-security
Read post →

Korea AI Basic Act AI Compliance Checklist: Ten Actions Before the Grace Period Closes

South Korea''s AI Basic Act took effect on 22 January 2026 with a one-year grace period on administrative fines that closes on 22 January 2027. This is a working checklist of ten actions for an operator running AI traffic into or out of Korea, covering the high-impact determination, the domestic representative thresholds, prior notification, generative AI labelling, human supervision, and the evidence each action produces. Every item names the artifact an MSIT inspection reads rather than the policy it references.

complianceai-governanceauditregulationai-security
Read post →

MITRE ATLAS AI Audit Evidence: The Telemetry That Proves a Technique Fired

MITRE ATLAS reached 16 tactics, 84 techniques, 56 sub-techniques, 32 mitigations, and 42 case studies at version 5.1.0 in November 2025, with agent-focused techniques added in the February 2026 update. A technique is only useful in a review if you can show whether it fired. This walks the evidence artifacts that answer that question for the ATLAS tactics reachable over HTTP AI traffic, and names the tactics where no request-path telemetry helps.

ai-securityllm-securityauditforensic-auditai-governance
Read post →

MITRE ATLAS AI Compliance Checklist: Ten Actions Against the Techniques That Reach Your Traffic

MITRE ATLAS carries 16 tactics and 84 techniques as of version 5.1.0 in November 2025, with agent-focused additions landing in February 2026. Most of the matrix describes attacks on models you train. This checklist works the subset that reaches an enterprise consuming hosted models over HTTP, giving ten actions with the ATLAS tactic each one addresses and the evidence it produces, and marking the techniques that need build-pipeline work instead.

ai-securityllm-securityprompt-injectionauditai-governance
Read post →

MITRE ATLAS AI Controls Mapping: Which Tactics Reach an HTTPS Request and Which Never Will

MITRE ATLAS holds 16 tactics and 84 techniques as of version 5.1.0 in November 2025, with agent techniques added in February 2026. Around a dozen of those techniques reach an enterprise consuming hosted models, and the rest target training pipelines and model artifacts. This maps the reachable tactics onto the technical control that addresses each one at the AI request boundary, names the evidence produced, and marks the tactics where a request-path control has nothing to offer.

ai-securityllm-securitypolicy-enforcementprompt-injectionai-governance
Read post →

NIST SP 800-171 AI Compliance Checklist: Ten Actions Before CUI Reaches a Model API

NIST SP 800-171 Revision 3 carries 97 requirements across 17 families and never mentions AI, which is why a single prompt carrying Controlled Unclassified Information to a commercial model endpoint engages five families at once. This checklist gives ten actions for a contractor whose engineers already have access to hosted models, naming the requirement family each one serves and the artifact it produces for an assessment.

complianceai-governanceauditnistai-security
Read post →

NIST SP 800-171 AI Audit Evidence: What an Assessor Asks When CUI Reaches a Model

NIST SP 800-171 Revision 3, finalised on 14 May 2024, carries 97 security requirements across 17 families and governs Controlled Unclassified Information in nonfederal systems. An engineer pasting CUI into a hosted model moves that data outside the assessed boundary in one HTTPS request. This walks the evidence artifacts an assessor requests once AI traffic is in scope, family by family, and names where the assessment boundary actually sits.

complianceai-governanceauditnistai-security
Read post →

NIST SP 800-53 AI Audit Evidence: What an Assessor Reads Before the COSAiS Overlays Land

NIST SP 800-53 Revision 5 organises its catalogue into 20 control families, and the COSAiS project launched in July 2025 to build AI-specific overlays on top of them. The overlays are still in draft, with an annotated outline for predictive AI published on 8 January 2026. This walks the evidence artifacts an assessor already asks for under the AU, IA, AC, SC, SI, and SR families once AI traffic is in a system boundary, ahead of any overlay being finalised.

complianceai-governanceauditnistai-security
Read post →

NIST SP 800-171 AI Controls Mapping: Six Requirement Families Against One Boundary Crossing

NIST SP 800-171 Revision 3 holds 97 requirements across 17 families and treats a commercial model endpoint as what it is: a system outside the assessed boundary. This maps the six families that a prompt carrying Controlled Unclassified Information engages onto the technical control that enforces each one at the AI request boundary, names the evidence produced, and identifies the families that need work elsewhere in the environment.

complianceai-governancepolicy-enforcementnistai-security
Read post →

NIST SP 800-53 AI Controls Mapping: Control IDs an AI Gateway Answers

SP 800-53 Revision 5 organises its catalogue into 20 control families, and the COSAiS overlay work that will tailor it for AI is still in draft. An AI system inside an authorisation boundary is assessed today against control identifiers that already exist. This maps the specific controls an identity-aware gateway on AI traffic satisfies, at the AC-3, AC-4, AU-3, AU-9, IA-2, SC-7, SI-4 and SR-3 level, and names the ones it contributes nothing to.

nistcomplianceai-governancearchitectureauditpolicy-enforcement
Read post →

NIST SP 800-53 AI Compliance Checklist: 12 Items to Close Before Assessment

An AI system inside an authorisation boundary gets assessed against SP 800-53 Revision 5 control identifiers that already exist, ahead of any COSAiS overlay being finalised. This is a sequenced checklist of 12 items, each written with the control it satisfies and an objective completion test an assessor could run. It starts with endpoint inventory and identity binding, because every later item inherits whatever those two produce.

nistcomplianceai-governanceauditai-security
Read post →

NIST CSF 2.0 AI Controls Mapping: AI Traffic Across the Six Functions

NIST released Cybersecurity Framework 2.0 on 26 February 2024 with a sixth Function, GOVERN, sitting at the centre of the other five. AI traffic between authenticated callers and model endpoints falls across GV.SC, ID.AM, PR.AA, PR.DS, DE.CM and RS.AN without any AI-specific subcategory being written. This maps the categories an identity-aware gateway answers, the outcome each one expects, and the parts of the Framework it contributes nothing to.

nistcomplianceai-governancearchitecturezero-trustpolicy-enforcement
Read post →