← All posts

Compliance & Regulation

402 posts on compliance & regulation.

ISO 42001 Audit Evidence: What an AI Gateway Record Proves for Your AIMS

ISO 42001 certifies an AI management system, and a certification audit tests whether your controls operate and asks for evidence. Most AIMS documentation describes policy for AI use without a record that a given model call was governed. This piece maps AI gateway records onto the ISO 42001 controls an auditor samples, so operational control over AI use produces artifacts instead of assertions.

iso-42001'compliance''ai-audit''evidence''aims'
Read post →

AI Audit Log Retention Requirements: How Long to Keep Model Call Records

Different regimes impose different retention obligations on AI records, and the safe default is the longest applicable period. This piece walks the retention expectations behind EU AI Act record-keeping, SOC 2 observation windows, and financial-sector rules, then shows what a per-decision model call record has to carry to still be useful years after the request it documents.

ai-audit'compliance''audit-logs''eu-ai-act''retention'
Read post →

AI Incident Response Automation: Where Machine-Speed Containment Actually Belongs

Automating incident response for AI traffic means being precise about which part of the response can run without a human and which cannot. Google Mandiant M-Trends 2026 puts median attack handoff at 22 seconds, faster than any analyst can triage. This piece separates the containment decision (which belongs inline, at the AI request boundary, where a policy violation can be blocked before it executes) from the investigation and recovery work that automation can accelerate but not replace, and shows how a structured audit record turns an AI incident into something an automated pipeline can act on.

ai-securityinline-enforcementforensic-auditauditagentic-aicompliancepolicy-enforcement
Read post →

AI Agent Incident Response: The Evidence You Need When an Agent Is in the Blast Radius

When an AI agent is part of a security incident, the responding team needs to answer three questions per action: which identity authorized the call, what policy applied, and what the agent asked the model. Google Mandiant M-Trends 2026 puts the median handoff from initial access to a secondary threat group at 22 seconds, a tempo that turns after-the-fact log review into forensic archaeology. This piece defines the evidence an incident response team needs from AI traffic, where most teams are blind, and how EU AI Act Article 12 raises the bar on the record.

agentic-aiai-securityforensic-auditauditidentity-and-authorizationcomplianceeu-ai-act
Read post →

ISO 42001 Certification: The Audit Stages, the Annex A Controls, and the AI Traffic Evidence Most Teams Cannot Produce

ISO/IEC 42001:2023 is the first management system standard for AI, and certification against it runs through a Stage 1 documentation review and a Stage 2 implementation audit by an accredited certification body, followed by a three-year cycle with annual surveillance. The auditor asks for evidence that the Annex A controls actually operate. For the controls that govern AI inference traffic, access, and logging, most teams cannot produce a record tied to who sent what to which model. This piece walks the certification path and the evidence gap on AI request traffic.

iso-42001ai-governancecomplianceai-audit-loggingidentity-and-authorizationaudit-and-evidenceai-management-system
Read post →

Australia Privacy Act AI Compliance Checklist: Ten Items Before a Prompt Carries Personal Information

A working checklist for Australian organisations running AI over personal information under the Privacy Act 1988 and the Australian Privacy Principles, with the automated decision-making transparency obligations landing 10 December 2026. Each item names the obligation, the concrete action, and the evidence to produce, so the list doubles as an audit-readiness pass rather than a set of intentions. Ordered by what an OAIC inquiry reaches for first.

complianceai-governanceregulationauditai-security
Read post →

Australia Privacy Act AI Audit Evidence: What the OAIC Asks For and Where Each Artifact Comes From

Australia has no dedicated AI Act. AI that processes personal information is governed under the Privacy Act 1988 and the Australian Privacy Principles, enforced by the OAIC, with new automated decision-making transparency obligations from the Privacy and Other Legislation Amendment Act 2024 taking effect 10 December 2026. When the OAIC opens an inquiry, it asks for evidence, not intent. This walks the specific artifacts an AI privacy review produces and marks which system each one has to come from.

complianceai-governanceregulationauditai-security
Read post →

Brazil LGPD AI Audit Evidence: What the ANPD Expects When a Prompt Carries Personal Data

Brazil governs AI through the LGPD (Law 13.709/2018) while its dedicated AI bill, PL 2338/2023, moves through the Chamber of Deputies after the Senate approved it on 10 December 2024. The ANPD enforces the LGPD, and its 2025 technical note on automated decisions signals where scrutiny is heading. This walks the specific evidence an LGPD review of an AI system expects, from Article 20 automated decisions to Articles 33 to 36 international transfers, and marks which system each artifact has to come from.

complianceai-governanceregulationauditai-security
Read post →

Australia Privacy Act AI Controls Mapping: Australian Privacy Principles to Enforcement Points

The Australian Privacy Principles were written for personal information handling in general, and they apply to AI traffic without a translation layer. This maps the APPs that bite when a prompt carrying personal information leaves your network, plus the automated decision-making obligations effective 10 December 2026, to the specific technical control and enforcement point that satisfies each one. The mapping is deliberately concrete: obligation, where it applies in the request flow, the control, and the evidence the control produces.

complianceai-governanceregulationpolicy-enforcementai-security
Read post →

Brazil LGPD AI Compliance Checklist: Ten Items Before a Prompt Carries Personal Data

A working checklist for organisations running AI over personal data under the LGPD (Law 13.709/2018), enforced by the ANPD, while PL 2338/2023 advances through the Chamber of Deputies. Each item names the article, the concrete action, and the evidence to produce, so the list functions as an audit-readiness pass rather than a statement of principles. Ordered the way an ANPD review moves: identity and records, then legal basis, then transfers, then automated decisions.

complianceai-governanceregulationauditai-security
Read post →

Brazil LGPD AI Controls Mapping: LGPD Articles to Enforcement Points

The LGPD (Law 13.709/2018) governs AI in Brazil today, and each of its articles attaches to a concrete moment in the AI request flow. This maps the LGPD obligations that bite when a prompt carrying personal data leaves your network, from the Article 6 accountability principle to Article 20 automated decisions and the Articles 33 to 36 transfer rules, onto the technical control and enforcement point that satisfies each. The mapping stays concrete: article, where it applies, the control, and the evidence produced.

complianceai-governanceregulationpolicy-enforcementai-security
Read post →

Canada AIDA AI Audit Evidence: What an Audit Asks For Now That AIDA Never Passed

The Artificial Intelligence and Data Act died with Bill C-27 when Parliament prorogued on 6 January 2025, and it has not been reintroduced. Canadian AI programmes still face audits, run under PIPEDA accountability, Quebec Law 25 section 12.1, OSFI guidance, and the Treasury Board Directive on Automated Decision-Making. This walks the specific evidence artifacts those reviews ask for when a prompt carrying personal information leaves your network, and names which system each artifact has to come from.

complianceai-governanceregulationauditai-security
Read post →