← All posts

Compliance & Regulation

305 posts on compliance & regulation.

Saudi PDPL AI Controls Mapping: Each Obligation Against the Control That Satisfies It

Saudi Arabia enforces the PDPL through SDAIA, the same authority that holds the national AI mandate, and its committees have issued 48 decisions since the transition period closed on 14 September 2024. This maps the operative obligations, legal basis, records of processing, impact assessment, cross-border transfer, safeguards, breach notification and data subject rights, to the control that satisfies each for AI traffic, with the owner named and an honest coverage verdict.

complianceregulationai-governanceai-compliancedata-privacypolicy-enforcement
Read post →

Saudi PDPL AI Compliance Checklist: 12 Items With an Objective Completion Test

SDAIA has issued 48 enforcement decisions since the PDPL transition period closed on 14 September 2024, concentrated on legal basis, unauthorised disclosure, absent safeguards and marketing consent. This is a twelve-item checklist for an organisation running AI on personal data in the Kingdom, ordered by dependency rather than by statutory sequence, each item carrying a test somebody outside the privacy team could run, and honest about the five items no architecture closes.

complianceregulationai-complianceai-governancedata-privacyaudit
Read post →

Singapore PDPA AI Audit Evidence: The Records Behind a Defensible AI Deployment

Singapore PDPA AI audit evidence starts with the records behind each deployed request: purpose, notice, consent or exception, originating identity, data class, destination, policy outcome, retention and breach assessment. This guide builds the evidence package around the PDPC obligations and its 1 March 2024 AI guidance, then separates runtime proof from privacy work that stays off the request path.

complianceregulationai-governanceai-complianceauditpolicy-enforcement
Read post →

Singapore PDPA AI Compliance Checklist: 12 Items With a Completion Test

This Singapore PDPA AI compliance checklist turns the PDPC obligations into twelve dependency-ordered actions for an organisation deploying AI. Each item names an owner, an objective completion test and the evidence to retain, covering scope, purpose, notification, accountability, protection, overseas transfers, retention, access and breach response without assigning legal work to an HTTP gateway.

complianceregulationai-complianceai-governanceauditpolicy-enforcement
Read post →

Singapore PDPA AI Controls Mapping: Obligation, Owner, Test and Evidence

This Singapore PDPA AI controls mapping connects the Commission’s obligations to a control objective, accountable owner, implementation point, test and evidence artifact. It covers purpose, notification, consent, accountability, protection, accuracy, retention, overseas transfers, access, correction and breach notification, with Full, Partial and Outside verdicts that keep a request gateway inside its real boundary.

complianceregulationai-governanceai-compliancepolicy-enforcementaudit
Read post →

StateRAMP AI Audit Evidence: Build a Package an Assessor Can Replay

StateRAMP AI audit evidence has to connect the authorization boundary, NIST SP 800-53 Revision 5 control narrative, tested AI request, and retained decision record. This guide organizes the package around sampling, replay, custody, integrity, and retrieval so a 3PAO can trace one authenticated caller through an LLM transaction without reconstructing the event from unrelated logs.

ai-complianceai-governanceauditforensic-auditnistzero-trust
Read post →

StateRAMP AI Compliance Checklist: 10 Tests for the Revision 5 Package

This StateRAMP AI compliance checklist turns the current GovRAMP Revision 5 package into 10 gradable actions for AI-enabled cloud services. Each item names an owner, required evidence, and a pass condition covering the assessed boundary, AI disclosures, identity, model routes, prompt protection, audit records, continuous monitoring, incident drills, and responsibility gaps.

ai-complianceai-governancecomplianceauditnistzero-trust
Read post →

StateRAMP AI Controls Mapping: Revision 5 Coverage at the LLM Boundary

This StateRAMP AI controls mapping connects selected NIST SP 800-53 Revision 5 controls to the authenticated HTTP request path between an application and an LLM. It names the control objective, implementation point, owner, test, evidence, and coverage level, then separates gateway contributions from IAM, platform, model, governance, and incident-response responsibilities.

ai-complianceai-governancenistarchitecturepolicy-enforcementzero-trust
Read post →

Switzerland FADP AI Audit Evidence: Build the Record Before the Review

The Swiss FADP has applied to AI-supported processing since 1 September 2023. An evidence package has to connect each live model route to purpose, recipients, foreign disclosures, security measures, impact assessment findings and automated-decision rights. This guide builds that package around traceable samples rather than policy statements.

complianceregulationai-complianceai-governanceauditai-security
Read post →

Switzerland FADP AI Compliance Checklist: 11 Tests for a Live Deployment

The Swiss FADP has governed AI-supported personal-data processing since 1 September 2023. This eleven-item checklist follows implementation dependencies: inventory, purpose, processor terms, records, foreign disclosure, transparency, automated decisions, DPIA, security, rights and incidents. Every item names an owner, evidence and a completion test.

complianceregulationai-complianceai-governanceauditai-security
Read post →

Switzerland FADP AI Controls Mapping: Duty, Owner, Test and Evidence

The Swiss FADP applies directly to AI-supported personal-data processing. This mapping connects Articles 6 through 25 to a control objective, accountable owner, implementation point, test and evidence artifact. It marks gateway coverage as full, partial or outside scope so legal duties remain with legal owners and request-path controls stay technically defensible.

complianceregulationai-complianceai-governancepolicy-enforcementai-security
Read post →

Texas TRAIGA AI Audit Evidence: Build the Eight-Part Attorney General File

Texas TRAIGA took effect on 1 January 2026 and gives the Attorney General exclusive enforcement authority. The enacted law identifies eight categories of documentation the Attorney General may request after a consumer complaint, then gives a 60-day cure process with supporting documentation. This guide turns those statutory requests into a defensible evidence file without inventing a universal logging mandate.

complianceregulationai-complianceai-governanceauditpolicy-enforcement
Read post →