← All posts

Compliance & Regulation

402 posts on compliance & regulation.

ISO 42001 Implementation Guide: How to Stand Up an AI Management System That Passes Certification

ISO/IEC 42001:2023 is the first international management-system standard for AI. The standard takes the ISO management-system structure (the same Annex SL Harmonized Structure used in ISO 9001, ISO 27001, and ISO 14001) and applies it to AI. Certification requires a documented AI management system covering scope, leadership, planning, support, operations, performance evaluation, and improvement. This piece walks through the certification path step by step, the Annex A controls that have to be operational, the audit evidence the certification body expects, the implementation timeline a typical mid-market organization runs, and where the AI-specific controls intersect the inspection-layer architecture.

iso-42001aimsai-management-systemai-compliancecertificationaudit-logs
Read post →

ISO 42001 vs ISO 27001: How the AI Management System Layers on Top of Information Security

ISO 42001 and ISO 27001 share the same management-system structure (the Annex SL Harmonized Structure) and a substantial portion of the Annex A control catalog. Organizations with an ISO 27001 certification have a head start on ISO 42001 because the management-system processes transfer with modifications. The two standards address different risk domains: 27001 covers information security risks to confidentiality, integrity, and availability of information assets, while 42001 covers AI-specific risks to fairness, reliability under adversarial pressure, transparency, accountability, and the responsible use of AI systems. This piece walks through the structural overlap, the additive AI-specific controls 42001 introduces, the integration pattern for combined audits, and the inspection-layer architecture that produces evidence under both standards.

iso-42001iso-27001aimsismsai-compliancecertification
Read post →

Due Diligence Is Not Due Care: The AI Compliance Gap That Closes at the Request Layer

Due diligence is the procurement check a deployer runs once when selecting an AI vendor. Due care is the ongoing operational obligation that runs every time the AI system produces a decision. Most enterprises confuse the two. The vendor security questionnaire, the SOC 2 report, and the BAA cover the diligence side. The due care side is the per-decision evidence the regulator reads at audit time. This piece walks through the legal distinction, the regulatory regimes that depend on it, and the request-layer architecture that produces due care evidence on demand.

due-careai-complianceai-governanceaudit-logseu-ai-actliability
Read post →

EU AI Act Fines: How Article 99 Sets €35M / €15M / €7.5M Tiers and Who Pays Each One

Article 99 of the EU AI Act sets three penalty tiers. €35 million or 7% of global turnover for prohibited practices. €15 million or 3% for the obligations listed in Article 99(4). €7.5 million or 1% for supplying incorrect or misleading information. The higher of the absolute figure and the percentage applies to undertakings, and the lower of the two applies to SMEs and start-ups under Article 99(6). This piece walks the exact article list behind each tier, the crossover turnover where the percentage starts to bind, and which obligations are actually live after the July 2026 omnibus deferral.

eu-ai-actcomplianceai-governanceregulationauditai-security
Read post →

EU AI Act for HR: Annex III Point 4 and the December 2027 Deadline

The current EU AI Act places recruitment, promotion, termination, task allocation, and worker-monitoring systems in Annex III point 4, subject to the Article 6(3) exception. Regulation (EU) 2026/1744 moved the main Chapter III high-risk duties for these systems to 2 December 2027. This guide separates the duties already in force, the later high-risk controls, deployer notices, logging and retention, impact assessments, and explanation rights.

eu-ai-acthrrecruitmenthigh-risk-aicompliancearticle-12
Read post →

LLM Prompt Logging: What an Article 12 Compliant Record Has to Contain

LLM prompt logging records every prompt sent to an LLM, the response the model returned, the identity that initiated the call, the policy that governed the decision, and the data classifications detected. The EU AI Act Article 12 obligation, the NIST AI RMF Manage function, and the Fannie Mae LL-2026-04 disclosure mandate each expect this record at a specific granularity. I walk through what the record contains, where most application logging falls short, and how the architectural pattern that produces a compliant record differs from application-side logging.

llm-loggingauditeu-ai-actcompliancearticle-12audit-trail
Read post →

AI Decision Records: The Structured Evidence Layer the Compliance Set Reads Across Regimes

AI decision records are the structured evidence layer that captures who acted, what model handled the request, what policy governed it, what data classifications applied, and what the outcome was. The 2026 regulatory set reads decision records as the primary evidence for AI system operation. EU AI Act Article 12, Fannie Mae LL-2026-04, NIST AI RMF Manage, ISO 42001 clause 8.3, and Texas TRAIGA each expect the records at a specific granularity. I walk through what a portable decision record schema looks like, what each regime reads from it, and how the same record satisfies multiple regimes at once.

auditdecision-recordscomplianceeu-ai-actnist-ai-rmfiso-42001
Read post →

AI Governance Audit: What an Auditor Asks For and How Architecture Produces It

An AI governance audit asks for system inventory, identity context per AI call, data classification on prompt content, policy state at decision time, and an evidence trail an external party reads. Application-controlled logs collapse under those questions because the system being audited is also the system producing the audit record. The architecture that survives an AI governance audit is a decoupled enforcement layer that produces structured, signed decision records the application never had custody over.

ai-governanceauditcomplianceeu-ai-actregulation
Read post →

The Future of AI Governance: Five Architectural Shifts Already Underway in 2026

The future of AI governance is not a question of which framework will win. The shift is from documentation-based programs to per-decision evidence captured at the AI request boundary. The five concrete moves already underway in 2026 are convergence on the inline enforcement boundary, codification of per-decision audit records, identity-attached AI requests, machine-readable policies, and external certification bodies for AI management systems. Each shift moves the governance work from quarterly committee meetings into the AI request path itself.

ai-governanceeu-ai-actiso-42001complianceregulation
Read post →

EU AI Act Article 15: What the Accuracy, Resilience, and Cybersecurity Obligation Requires

Article 15 of the EU AI Act sets the accuracy, resilience, and cybersecurity floor for high-risk AI systems before the August 2, 2026 deadline. The obligation runs end to end across the deployment, from the declared accuracy metric in the technical documentation to the runtime behavior under adversarial pressure. This article walks through the regulation text, the structural gaps in most deployments, and the architectural pattern that satisfies all three properties together.

eu-ai-actai-complianceai-securityregulationinline-enforcement
Read post →

EU AI Act Prohibited Practices: What Article 5 Bans and How Enforcement Catches It

Article 5 of the EU AI Act lists the practices the regulation prohibits outright. Subliminal manipulation, exploitation of vulnerability, social scoring by public authorities, predictive policing based on profiling, untargeted facial scraping, emotion inference in workplaces and schools, biometric categorisation by protected characteristic, and most real-time biometric identification in public spaces. The prohibitions took effect February 2, 2025. The €35 million / 7% penalty tier applies. This article walks through the eight prohibitions and the architecture that catches them at the AI request boundary.

eu-ai-actai-complianceregulationai-governanceinline-enforcement
Read post →

EU AI Act Codes of Practice: What the GPAI Provisions Expect and Where Deployers Sit

The Codes of Practice in the EU AI Act are the operational mechanism that translates the GPAI obligations under Articles 53 and 55 into concrete commitments providers can sign. The Code on General-Purpose AI Models, published by the AI Office, sets out the transparency, copyright, and safety expectations the providers have agreed to. Deployers that build on top of GPAI inherit downstream obligations and a set of expectations the deployer cannot delegate to the provider.

eu-ai-actai-complianceai-governanceregulationllm
Read post →