← All posts

Compliance & Regulation

402 posts on compliance & regulation.

AI Risk Register Template: What Each Row Has to Capture and Where the Evidence Comes From

An AI risk register is the operational artefact that records the risks the deployer has identified for each AI system, the controls applied, the residual risk, and the evidence that the controls are working. EU AI Act Article 9, NIST AI RMF, ISO 42001, and Fannie Mae LL-2026-04 each expect a register the deployer can produce on demand. This article walks through the columns that hold up across regimes and the runtime evidence each column depends on.

ai-governanceai-complianceeu-ai-actiso-42001audit
Read post →

EU AI Act Article 11: What Technical Documentation Must Show for Your AI System

Article 11 of the EU AI Act requires providers of high-risk AI systems to prepare and keep up-to-date technical documentation before placing the system on the market. The documentation has to demonstrate conformity with the high-risk requirements and be detailed enough that a national authority can assess it. Most engineering teams treat technical documentation as a deliverable rather than a continuously maintained artifact, and that habit fails Article 11 the first time a market surveillance authority asks for the file.

eu-ai-actai-governancecomplianceauditdocumentationregulation
Read post →

AI Vendor Due Diligence Questionnaire: What to Ask Before You Buy

AI vendor due diligence happens at the procurement gate, runs against a standard questionnaire, and produces an attestation file. The questionnaire most teams inherited from cloud SaaS vendors does not cover the questions a regulator will actually ask about AI use. The Fannie Mae LL-2026-04 framework, the EU AI Act, and the NIST AI RMF all expect ongoing due care, not one-time due diligence. This piece walks through the question categories an AI-aware procurement gate has to cover, the answers that have to live in the file, and the runtime evidence that closes the gap between due diligence and due care.

ai-governancevendor-riskcomplianceprocurementdue-diligenceaudit
Read post →

Enterprise AI Governance: What the Operational Layer Actually Has to Produce

Enterprise AI governance gets framed as a policy program. The policies are necessary, but they sit on top of an operational layer that produces evidence, enforces controls, and tracks decisions in real time. This article walks through the four artifacts a real enterprise AI governance program needs at the operational layer: the AI system inventory, the per-decision audit record, the policy enforcement record, and the incident reconstruction artifact. Each is mapped to specific regulatory regimes and to the questions a board will ask.

ai-governanceenterprisecomplianceauditregulationai-security
Read post →

AI Bill of Materials (AIBOM): The Inventory Layer Compliance Teams Keep Skipping

Search interest in "AIBOM" and "AI bill of materials" is climbing fast, but the SERP is owned by vendors selling tooling rather than explainer content. This article defines AIBOM in concrete terms, compares it to the Software Bill of Materials (SBOM), maps the artifact to NIST AI RMF and EU AI Act Article 11 documentation requirements, and walks through what an AIBOM actually contains: model card references, training data lineage, inference dependencies, and gateway policy version. The per-decision audit log of LLM traffic is the inference-layer AIBOM artifact most programs are missing.

ai-governancecomplianceai-complianceauditeu-ai-actnist-ai-rmf
Read post →

DORA and AI: what EU financial entities have to map by January 2027

The EU Digital Operational Resilience Act took effect January 17, 2025 and treats LLM vendors as critical ICT third parties at scale. By January 2027, EU financial entities have to maintain a Register of Information covering ICT third-party arrangements, run exit-strategy testing for material providers, manage concentration risk, and produce per-decision audit trails for AI-influenced decisions. This piece walks through what DORA actually requires from an AI program and the architecture that satisfies it.

dorafinancial-servicesai-governanceeu-regulationauditbanking
Read post →

HIPAA-compliant LLMs: what the deployer has to produce when OCR shows up

HIPAA does not approve LLMs. HIPAA places obligations on covered entities and business associates around how PHI gets used, accessed, and audited. When OCR opens a complaint review of a clinical AI deployment, the questions are specific: who accessed PHI in what context, with what authorization, with what evidence. This piece walks through what HIPAA actually requires from an AI deployment, what a Business Associate Agreement does and does not cover, and the architecture that produces the audit artifact OCR will ask for.

hipaahealthcarephicomplianceauditclinical-ai
Read post →

AI Compliance Jobs: What the Roles Actually Do and the Evidence Auditors Expect

AI compliance roles emerged in 2024 and turned into named job families in 2025. The four common roles are AI Compliance Officer, AI Risk Manager, AI Audit Lead, and AI Governance Engineer. Each operates against a different evidence surface: regulatory mapping, risk register entries, audit trail review, and control implementation. Hiring against the wrong evidence surface is the most expensive mistake compliance leaders make.

ai-governancecompliancecareersauditriskeu-ai-act
Read post →

The Centre for the Governance of AI: What GovAI Research Tells Enterprise CISOs and Where the Gap Sits

The Centre for the Governance of AI (GovAI) is the Oxford-affiliated research organization that publishes some of the most-cited work on AI policy, model evaluations, frontier model governance, and international AI agreements. Enterprise CISOs reading the research will recognize the intellectual scaffolding under EU AI Act and NIST AI RMF text. The gap between research framework and enterprise control sits at the request boundary.

ai-governancegovairesearcheu-ai-actnist-ai-rmfpolicy
Read post →

AI Governance Policy: The Operational Document That Survives a Regulatory Inquiry

Most AI governance policies fail their first regulatory inquiry because they document intent without describing the mechanism that enforces it. The structure that survives names the AI systems in scope, ties each one to a risk tier, attaches identity-bound enforcement at the request layer, and produces a per-decision audit record. This walkthrough covers the seven sections a policy needs to be operational rather than aspirational, the wording auditors expect, and the evidence each section has to point to.

ai-governancepolicycomplianceeu-ai-actauditrisk-management
Read post →

AI Data Residency Controls: Enforcing the Region Boundary at the Gateway

AI data residency requirements show up under GDPR, the EU AI Act, sector regulations like DORA and HIPAA, and national rules such as the Reserve Bank of India circulars. The control that survives audit binds the residency rule to the request at the gateway, routes the call to a region-resident model endpoint, and records the region of decision in the per-decision audit log. This walkthrough covers the three residency conditions, the routing patterns that enforce them, and the audit-record fields that survive a regulator request.

data-residencygdpreu-ai-actcomplianceai-governancecross-border
Read post →