← All posts

Compliance & Regulation

305 posts on compliance & regulation.

AI Governance Tools Comparison: Where Each Category Sits and Which Obligation It Closes

AI governance tools comparison work usually treats the category as a flat list of competitors. The 2026 reality is that the category covers four very different product shapes that sit at different layers and close different obligations under EU AI Act Article 12, Fannie Mae LL-2026-04, NIST AI RMF, and ISO 42001. This piece compares the four shapes against each obligation and shows the combination most regulated buyers actually need.

ai-governanceai-governance-toolscomplianceeu-ai-actvendor-evaluationprocurement
Read post →

Compliance After the Act: The EU AI Act Mindset Shift From Documentation to Per-Decision Evidence

EU AI Act Article 12 takes effect August 2, 2026 and changes what regulators ask of high-risk AI systems. Compliance teams that came from GDPR are familiar with management-level documentation regimes. The Act asks for operational-level per-decision evidence. This piece walks through the four mindset shifts a security and compliance organization has to make: from policy documents to live audit records, from quarterly reviews to per-request decisions, from third-party attestation to first-party evidence, and from boundary controls to per-route enforcement.

eu-ai-actarticle-12complianceaudit-logshigh-risk-aigovernance
Read post →

EU AI Act vs GDPR: How the Two Regimes Diverge on Record-Keeping, Identity, and the Per-Decision Trace

Compliance teams reach for the GDPR record-keeping playbook when the EU AI Act lands on the legal calendar. The two regimes overlap on data subject rights and personal-data scope. They diverge on the cadence of evidence, the identity of the actor the record describes, and the per-decision trace the AI Act requires. This piece walks through the five axes where the regimes diverge, the record formats each regulator reads, and the architectural changes the AI request path needs before August 2, 2026.

eu-ai-actgdprcompliancearticle-12audit-logsgovernance
Read post →

EU AI Act Fines: How Article 99 Sets €35M / €15M / €7.5M Tiers and Who Pays Each One

Article 99 of the EU AI Act sets three penalty tiers. €35 million or 7% of global turnover for prohibited practices. €15 million or 3% for the obligations listed in Article 99(4). €7.5 million or 1% for supplying incorrect or misleading information. The higher of the absolute figure and the percentage applies to undertakings, and the lower of the two applies to SMEs and start-ups under Article 99(6). This piece walks the exact article list behind each tier, the crossover turnover where the percentage starts to bind, and which obligations are actually live after the July 2026 omnibus deferral.

eu-ai-actcomplianceai-governanceregulationauditai-security
Read post →

EU AI Act Conformity Assessment: The Two Routes, Who Performs Each One, and What the Audit File Has to Contain

A high-risk AI system cannot be placed on the Union market without a conformity assessment. Article 43 allows two routes: an internal control procedure based on Annex VI, and a third-party procedure involving a notified body and Annex VII. The route depends on the system category. The audit file must contain the technical documentation listed in Annex IV, including the system architecture, the risk management process, the data governance approach, and the record-keeping system. Most enterprise deployers have not yet built the record-keeping side.

eu-ai-actcomplianceai-governanceauditregulationhigh-risk-ai
Read post →

EU AI Act for Healthcare: Why AI in Diagnostics, Triage, and Clinical Decision Support Lands in the High-Risk Category

Healthcare AI sits in the high-risk category by two paths. Annex III lists AI used in employment and essential services. The Medical Device Regulation pulls in any AI that meets the definition of a medical device, including most diagnostic and triage tools. The combination means most clinical AI deployments owe both the EU AI Act high-risk obligations and the MDR conformity assessment. The August 2, 2026 deadline applies, and the record-keeping infrastructure most hospitals run today fails the Article 12 test.

eu-ai-acthealthcarecomplianceai-governancemedical-deviceaudit
Read post →

EU AI Act for Fintech: Why Credit Scoring, Fraud Detection, and Insurance Pricing Land in the High-Risk Bucket

Annex III point 5(b) of the EU AI Act puts AI used in evaluating the creditworthiness of natural persons in the high-risk bucket. Annex III point 5(c) puts AI used in life and health insurance pricing in the same bucket. Fraud-detection AI used in retail banking sits in scope where it affects access to essential services. DORA, the Digital Operational Resilience Act, runs in parallel with overlapping log retention and incident reporting obligations. The August 2, 2026 high-risk deadline and the January 17, 2025 DORA effective date are both already binding.

eu-ai-actfintechdoracomplianceai-governanceaudit
Read post →

EU AI Act GPAI: What General-Purpose AI Model Providers Owe Under Article 51 and the Article 53 Code of Practice

Article 51 sets a separate obligation track for general-purpose AI models. Article 52 lists what counts as systemic-risk GPAI. Article 53 requires the provider to draw up technical documentation and to make information available to downstream providers. The GPAI obligations took effect August 2, 2025, ahead of the high-risk obligations. The Code of Practice published by the AI Office sets the practical compliance roadmap for the most-deployed foundation models in 2026.

eu-ai-actgpaifoundation-modelscomplianceai-governanceregulation
Read post →

EU AI Act Foundation Models: How the Regulation Treats Pre-Training, Fine-Tuning, and Substantial Modification

The EU AI Act does not use the term "foundation model" in its operative text. The regulation treats the underlying systems as general-purpose AI models under Article 51 and triggers systemic-risk obligations at 10^25 training FLOPs under Article 52. Fine-tuning and integration into downstream systems are handled separately by Article 25. The result is a layered obligation set that depends on whether the model is pre-trained, fine-tuned, or repurposed into a high-risk system.

eu-ai-actfoundation-modelsgpaicomplianceai-governanceregulation
Read post →

EU AI Act August 2, 2026 Deadline: The Operational Cutover for High-Risk AI Systems

August 2, 2026 is when the EU AI Act high-risk system obligations bind. The deadline applies to credit scoring, employment screening, education access, biometric identification, and the rest of the Annex III list. The operational cutover requires logging, identity binding on the AI request path, conformity assessment evidence, and the per-decision record under Article 12. This piece walks through the cutover, what the obligation expects, and what the operational stack has to produce.

eu-ai-actaugust-2-2026compliancehigh-risk-aiarticle-12
Read post →

EU AI Act and Open-Source AI: Where the Open-Weight Exemption Stops and the Deployer Obligation Starts

The EU AI Act carves out a limited exemption for free and open-source AI models in Recital 89 and Article 2. The exemption covers some provider obligations on the model itself but does not cover the deployer of a high-risk system that uses the model. This piece walks through what the exemption actually says, where the obligations remain bound to the deployer, and what the operational stack has to produce regardless of model licensing.

eu-ai-actopen-source-aicompliancedeployer-obligationsarticle-12
Read post →

EU AI Act Records of Processing: What the Article 12 + 19 Record Has to Contain Beyond GDPR Article 30

GDPR Article 30 records of processing describe what data the organization processes. EU AI Act Article 12 plus Article 19 records describe what the AI system did with a specific request at a specific moment. The two record series carry different fields at different granularities. This piece walks through the GDPR baseline, the Article 12 plus Article 19 fields, where they sit operationally, and what the audit expects on each.

eu-ai-actrecords-of-processinggdprarticle-12article-19
Read post →