← All posts

Compliance & Regulation

305 posts on compliance & regulation.

UK ICO AI Controls Mapping: Guidance, Owner, Test and Evidence

The ICO guidance on AI and data protection connects accountability, DPIAs, transparency, lawfulness, fairness, security, minimisation and individual rights. This mapping assigns each objective to an owner, implementation point, test and evidence artifact. It also records the ICO warning that the guidance is under review after the Data (Use and Access) Act and limits gateway coverage to routed HTTP model traffic.

complianceregulationai-complianceai-governancepolicy-enforcementaudit
Read post →

UK ICO AI Compliance Checklist: 11 Tests Tied to Current Guidance

This UK ICO AI guidance compliance checklist converts the regulator’s current AI chapters into eleven gradable tests for governance, transparency, lawfulness, fairness, accuracy, minimisation, security and rights. It records the guidance review warning and verifies operative duties against current UK data protection legislation.

complianceregulationai-complianceai-governanceauditpolicy-enforcement
Read post →

Utah AI Policy Act Audit Evidence: Build the Complaint and Disclosure File

Utah SB 149 created the Artificial Intelligence Policy Act in 2024, and SB 226 moved the consumer-protection rules into Chapter 75 in 2025. This guide builds an audit-evidence package around the current disclosure triggers, high-risk regulated-service rule, safe harbor, consumer-protection liability and Division enforcement. It separates statutory proof from useful HTTP operating evidence and keeps notice delivery with the application.

complianceregulationai-complianceai-governanceauditforensic-audit
Read post →

Utah AI Policy Act Controls Mapping: Trigger, Owner, Test and Evidence

Utah SB 226 replaced the original SB 149 consumer-facing AI provision with Chapter 13-75 in 2025. This mapping connects current scope, reactive disclosure, high-risk regulated-service notice, safe harbor, consumer-protection liability and enforcement response to accountable owners, implementation points, tests and evidence. Coverage is graded at the authenticated HTTP model boundary, with presentation and legal classification kept outside it.

complianceregulationai-complianceai-governancepolicy-enforcementaudit
Read post →

Utah AI Policy Act Compliance Checklist: 9 Tests for Current Disclosure Rules

Utah SB 226 replaced the original SB 149 consumer-facing provision with Chapter 13-75 in 2025. This nine-test checklist covers legal versioning, supplier and transaction scope, reactive consumer disclosure, high-risk regulated services, safe-harbor presentation, consumer-protection liability, complaint evidence, change control and HTTP operating records. Every item names an owner, evidence artifact and objective completion condition.

complianceregulationai-complianceai-governanceauditpolicy-enforcement
Read post →

Washington My Health My Data AI Compliance Checklist: 10 Production Tests

This Washington My Health My Data AI compliance checklist turns Chapter 19.373 RCW into ten production tests for AI services handling consumer health data. Each item names an owner, retained artifact and completion condition across scope, policy, consent, sharing, rights, processors, security, sale authorization and geofencing.

complianceregulationai-complianceai-governanceauditpolicy-enforcement
Read post →

Washington My Health My Data AI Audit Evidence: Reconstruct Model Disclosures

Washington’s My Health My Data Act covers identifiable health data outside familiar HIPAA assumptions, including some inferences produced with algorithms or machine learning. This guide builds an audit package for scope, privacy notices, consent, sharing, consumer requests, processors and security, then separates statutory proof from HTTP model-traffic evidence.

complianceregulationai-complianceai-governanceauditforensic-audit
Read post →

Washington My Health My Data Act AI Controls Mapping: Trigger, Owner, Test and Evidence

Washington''s My Health My Data Act separates collection consent from sharing consent, and sending consumer health data to an external model provider is a sharing event. This mapping connects RCW 19.373 duties for scope, privacy policy, dual consent, consumer rights, security practices, processors, authorization to sell and geofencing to accountable owners, implementation points, tests and evidence. Coverage is graded at the authenticated HTTP model boundary, with legal classification and consent capture kept outside it.

complianceregulationai-complianceai-governancepolicy-enforcementaudit
Read post →

HIPAA BAAs for AI Vendors: What the Agreement Has to Cover

A Business Associate Agreement with an AI vendor transfers HIPAA obligations under specific conditions. OpenAI, Anthropic, Microsoft, AWS, and Google offer BAAs to enterprise tiers. The agreement covers what the vendor does with PHI; it does not eliminate the covered entity duty to record disclosures.

hipaabaahealthcare-aicompliancevendor-managementaudit
Read post →

DORA Third-Party Risk for AI: What ICT Third-Party Providers Have to Show

DORA took effect January 17, 2025. The regulation treats AI vendors as ICT third-party service providers. Financial entities must maintain a register of contractual arrangements, monitor concentration risk, and demonstrate exit strategies. AI inference sits squarely inside the obligation.

dorathird-party-riskfinancial-servicescomplianceai-governanceict-risk
Read post →

EU AI Act Article 99: The Penalty Tiers and What Triggers Each One

Article 99 of the EU AI Act sets three penalty tiers reaching 35M EUR or 7% of global turnover for prohibited practices, 15M EUR or 3% for high-risk non-compliance, and 7.5M EUR or 1% for supplying misleading information. The mandate takes effect August 2, 2026.

eu-ai-actai-governancecompliancepenaltiesenforcementregulation
Read post →

NIST AI RMF Implementation: From Govern, Map, Measure, Manage to Production Controls

NIST AI RMF 1.0 defines four functions: Govern, Map, Measure, Manage. The framework is voluntary, but federal procurement and state AI laws increasingly cite it as the baseline. Implementation runs to dozens of decisions across identity, classification, policy enforcement, and audit. Most deployments stop at Govern.

nist-ai-rmfai-governancecomplianceai-securityrisk-managementaudit
Read post →