← All posts

Compliance & Regulation

305 posts on compliance & regulation.

AI Governance Framework: The Operational Layers Between Policy Documents and the Audit Record

An AI governance framework that survives an audit has three operational layers: a policy layer that names what the program will and will not do, an enforcement layer that binds the policy to production traffic, and a record layer that produces the per-decision evidence. This piece walks through each layer, what artifacts each one produces, and how the layers map to EU AI Act Article 12, NIST AI RMF, and ISO 42001.

ai-governance-frameworkai-governanceeu-ai-actnist-ai-rmfiso-42001
Read post →

Generative AI Governance: The Inspection-Layer Decisions That Sit Between Policy and Production

Generative AI governance has to bind organizational policy to per-request enforcement on the production traffic. The inspection layer between authenticated users or agents and any LLM is where the binding sits. This piece walks through the categories generative AI governance has to decide on, the enforcement placement, the record series, and how the program maps to EU AI Act Article 12 and NIST AI RMF.

generative-ai-governanceai-governanceeu-ai-actnist-ai-rmfinline-enforcement
Read post →

EU AI Act for Credit Scoring: Annex III Classification and Article 12 Logging

Annex III, point 5(b) of the EU AI Act classifies AI systems used to evaluate the creditworthiness of natural persons or establish their credit score as high-risk. The classification triggers Article 12 logging, Article 13 transparency, Article 14 human oversight, and Article 26 deployer obligations. The August 2, 2026 deadline applies. This piece walks through what the classification covers, what the operational requirements actually look like, and what the architecture for compliant credit scoring AI use looks like.

eu-ai-actcredit-scoringfintechhigh-risk-aicompliancearticle-12
Read post →

EU AI Act for HR: Annex III Point 4 and the December 2027 Deadline

The current EU AI Act places recruitment, promotion, termination, task allocation, and worker-monitoring systems in Annex III point 4, subject to the Article 6(3) exception. Regulation (EU) 2026/1744 moved the main Chapter III high-risk duties for these systems to 2 December 2027. This guide separates the duties already in force, the later high-risk controls, deployer notices, logging and retention, impact assessments, and explanation rights.

eu-ai-acthrrecruitmenthigh-risk-aicompliancearticle-12
Read post →

AI Governance Audit Framework: What Auditors Actually Test

An AI governance audit framework tests three layers: policy artifacts, control operation, and per-request evidence. The auditor reads the policy, samples requests, and traces each sampled request through the control to the evidence record. Programs that pass tend to share six properties. Programs that fail typically fail at the evidence layer because the audit record does not exist or is under the same control as the application generating the request. This piece walks through the framework, the six properties, and the architecture the framework depends on.

ai-governanceauditcomplianceeu-ai-actsoc-2iso-42001
Read post →

AI Governance and Risk Management: How the Two Programs Fit Together

AI governance sets the policies, roles, and accountability for AI use. Risk management identifies, measures, and treats the AI-specific risks the governance framework recognizes. The two programs share inputs (data classification, use case inventory, vendor list) and produce different outputs (policies versus risk treatments). Four frameworks draw the line differently: NIST AI RMF splits GOVERN from MAP/MEASURE/MANAGE, ISO 42001 hands the risk process to ISO 23894, the EU AI Act separates Articles 17 and 26 from Article 9, and SR 26-2 (which superseded SR 11-7 on 17 April 2026) separates board oversight from validation while placing generative and agentic AI outside its scope. This piece covers all four, plus the per-request evidence both programs need to demonstrate operation.

ai-governanceai-risk-managementnist-ai-rmfiso-42001complianceaudit
Read post →

EU AI Act Article 9: What the Risk Management System Obligation Requires

Article 9 of the EU AI Act requires a risk management system for every high-risk AI system, running as a continuous iterative process across the lifecycle. The obligations include risk identification, risk estimation, risk evaluation, and the adoption of risk management measures. The August 2, 2026 deadline applies. Most enterprise AI deployments treat risk management as a documentation exercise that ends at conformity assessment. The Article 9 reading expects an operating system that produces evidence at every decision point.

eu-ai-actarticle-9risk-managementcompliancehigh-risk-aigovernance
Read post →

EU AI Act Fines vs GDPR Fines: How the Two Penalty Regimes Compare

The EU AI Act and GDPR operate parallel penalty regimes. GDPR caps the highest tier at 20 million EUR or 4% of global annual turnover. The AI Act caps its highest tier at 35 million EUR or 7% for prohibited AI practices, with 15 million EUR or 3% for high-risk non-compliance and 7.5 million EUR or 1% for misleading information. The two regimes can apply concurrently. This piece walks through the tiers, the trigger conditions, the enforcement bodies, and where the obligations actually overlap.

eu-ai-actgdprcompliancepenaltiesregulationfines
Read post →

LLM Prompt Logging: What an Article 12 Compliant Record Has to Contain

LLM prompt logging records every prompt sent to an LLM, the response the model returned, the identity that initiated the call, the policy that governed the decision, and the data classifications detected. The EU AI Act Article 12 obligation, the NIST AI RMF Manage function, and the Fannie Mae LL-2026-04 disclosure mandate each expect this record at a specific granularity. I walk through what the record contains, where most application logging falls short, and how the architectural pattern that produces a compliant record differs from application-side logging.

llm-loggingauditeu-ai-actcompliancearticle-12audit-trail
Read post →

AI Decision Records: The Structured Evidence Layer the Compliance Set Reads Across Regimes

AI decision records are the structured evidence layer that captures who acted, what model handled the request, what policy governed it, what data classifications applied, and what the outcome was. The 2026 regulatory set reads decision records as the primary evidence for AI system operation. EU AI Act Article 12, Fannie Mae LL-2026-04, NIST AI RMF Manage, ISO 42001 clause 8.3, and Texas TRAIGA each expect the records at a specific granularity. I walk through what a portable decision record schema looks like, what each regime reads from it, and how the same record satisfies multiple regimes at once.

auditdecision-recordscomplianceeu-ai-actnist-ai-rmfiso-42001
Read post →

AI Governance Audit: What an Auditor Asks For and How Architecture Produces It

An AI governance audit asks for system inventory, identity context per AI call, data classification on prompt content, policy state at decision time, and an evidence trail an external party reads. Application-controlled logs collapse under those questions because the system being audited is also the system producing the audit record. The architecture that survives an AI governance audit is a decoupled enforcement layer that produces structured, signed decision records the application never had custody over.

ai-governanceauditcomplianceeu-ai-actregulation
Read post →

The Future of AI Governance: Five Architectural Shifts Already Underway in 2026

The future of AI governance is not a question of which framework will win. The shift is from documentation-based programs to per-decision evidence captured at the AI request boundary. The five concrete moves already underway in 2026 are convergence on the inline enforcement boundary, codification of per-decision audit records, identity-attached AI requests, machine-readable policies, and external certification bodies for AI management systems. Each shift moves the governance work from quarterly committee meetings into the AI request path itself.

ai-governanceeu-ai-actiso-42001complianceregulation
Read post →