← All posts

Compliance & Regulation

305 posts on compliance & regulation.

EU AI Act August 2, 2026 Readiness Checklist: The 32-Day Operational Sweep

On August 2, 2026, the EU AI Act high-risk system obligations take effect. Providers and deployers operating in the EU have 32 days from today to close the gap between the regulation as written and the operational evidence the supervisory authorities will ask for. This checklist walks the eight artifacts a high-risk deployer needs in production before August 2: the inventory, the classification, the Article 11 documentation, the Article 12 logging architecture, the Article 14 human oversight record, the Article 19 retention plan, the Article 26 deployer obligations, and the Article 73 incident reporting workflow.

eu-ai-actcompliancehigh-risk-airegulationauditai-governance
Read post →

NIST AI RMF MEASURE Function: The Controls That Produce Auditable Evidence

The NIST AI Risk Management Framework organizes risk management into four functions: GOVERN, MAP, MEASURE, and MANAGE. MEASURE is the function that produces the operational evidence the other three functions depend on. The framework defines four categories under MEASURE, with 18 subcategories that specify what to assess and how to assess it. This article walks each category, the controls a deployer needs in production to satisfy them, the artifacts the controls produce, and where a stateless policy gateway sits in the evidence chain.

nist-ai-rmfcompliancerisk-managementmeasurementauditai-governance
Read post →

EU AI Act General-Purpose AI: Article 53 Obligations, the August 2 Deadline, and the Deployer Consequences

The EU AI Act separates general-purpose AI (GPAI) rules from the high-risk system rules. GPAI obligations under Articles 53 through 55 sit with the model providers (OpenAI, Anthropic, Google, Mistral, Meta) and take effect August 2, 2026. Downstream deployers absorb second-order obligations through the technical documentation and evaluation records upstream providers must supply. This piece walks through what Article 53 requires from GPAI providers, what the systemic-risk threshold under Article 55 changes for the frontier labs, and the practical inspection-layer records a deployer running GPT-5, Claude 4, or Gemini 3 needs to keep against Articles 12, 13, and 26 in parallel.

eu-ai-actgpaigeneral-purpose-aiarticle-53article-55compliance
Read post →

GDPR AI DPIA: When Article 35 Requires an Assessment

A GDPR AI DPIA starts with the processing operation, not the presence of a model. This guide applies Article 35's likely-high-risk threshold, the nine WP248 rev.01 screening criteria, and EDPB Opinion 28/2024 to practical AI deployments. It also covers controller and processor roles, the minimum assessment record, Article 27 FRIA coordination, review triggers, and the limited but useful evidence available at an authenticated HTTP AI gateway.

gdprdpiaarticle-35privacyai-complianceedpb
Read post →

ISO 42001 Annex A Controls: The 38 AI Management Controls and Where Each One Lands in the Deployment

ISO 42001 Annex A lists 38 controls across nine areas (A.2 through A.10) that an organization implementing an AI Management System (AIMS) has to consider. Numbering starts at .2 in every area because the .1 position holds the control objective, and A.6 splits into A.6.1 and A.6.2 for a total of nine lifecycle controls. The auditor's Statement of Applicability records which controls the organization has implemented, which it has excluded (with justification), and which are partially implemented with a target date. This piece gives the full 38-control table with the deployment layer for each, the evidence a certification body accepts per area, what ISO/IEC 42006:2025 changed about who may audit you, and why an ISO 42001 certificate grants no presumption of conformity under EU AI Act Article 17.

iso-42001annex-aaimsai-management-systemai-compliancecertification
Read post →

NIST GenAI Profile (NIST AI 600-1): Risks, Actions, and Evidence

NIST AI 600-1 is a voluntary Generative AI Profile with 12 risk categories and suggested actions under GOVERN, MAP, MEASURE, and MANAGE. This current guide explains confabulation, correct action IDs, the relationship with OMB M-25-21, and the evidence an organization can collect without pretending one runtime log satisfies the whole framework.

nist-ai-rmfgenai-profilenist-ai-600-1omb-m-25-21compliancefederal
Read post →

PCI DSS 4.0 AI Controls: Where an LLM Deployment Touches the Cardholder Data Environment

PCI DSS 4.0 does not name AI systems in its 12 requirements. It does describe the cardholder data environment and the controls that apply to systems that store, process, or transmit cardholder data. An LLM deployment that touches cardholder data joins the CDE. This piece walks through the PCI DSS 4.0 requirements that apply to LLM deployments, the cardholder-data flow patterns that pull the LLM into scope, and the audit evidence a QSA accepts for the AI-specific controls at the gateway boundary.

pci-dsscompliancecardholder-dataai-securityllm-dlpai-gateway
Read post →

AI Audit Log Retention Under the EU AI Act: What Six Months Actually Means at the Storage Layer

Article 19 of the EU AI Act sets a minimum log retention floor of six months for high-risk AI systems, and existing sectoral rules extend it far beyond that. This piece walks through what the six-month floor means at the storage layer, how the retention interacts with GDPR, HIPAA, and financial-services record rules, and the inspection-layer architecture that produces logs suitable for both the retention window and the reconstruction test a regulator applies during an audit.

eu-ai-actai-audit-logscompliancelog-retentionai-governancearticle-19
Read post →

SOC 2 AI Controls Mapping: Which Trust Services Criteria a Policy Gateway Actually Evidences

SOC 2 auditors are asking about AI systems this year. The Trust Services Criteria did not change, but the scope of the audit expanded to cover AI request handling, model access controls, and AI-produced data. This piece maps CC6, CC7, and PI trust services categories to the inspection-layer controls that produce SOC 2 evidence for AI systems on a per-decision basis.

soc2ai-compliancetrust-services-criteriaauditai-governance
Read post →

The EU AI Act high-risk deadline just moved to December 2027. Here is what still hits on August 2, 2026

The EU Council gave final approval to the Digital Omnibus on AI on June 29, 2026, deferring standalone Annex III high-risk obligations from August 2, 2026 to December 2, 2027. Embedded high-risk systems slide to August 2, 2028. Article 50 transparency obligations still apply on August 2, 2026, and the grace period for AI-content labeling was cut from six to three months, landing on December 2, 2026. A new prohibition on non-consensual intimate imagery generation applies from December 2026. The workstreams a policy gateway supports keep their 2026 deadlines.

eu-ai-actcomplianceregulationai-governanceomnibusaudit
Read post →

SOC 2 AI Controls: Which Trust Services Criteria a Policy Gateway Actually Evidences

SOC 2 does not have an AI-specific control category, but every AI deployment inside a Type II audit surfaces control gaps under the same five Trust Services Criteria. The auditor questions center on who accessed the model, what data flowed through it, whether policy enforcement is deterministic, and whether the audit trail is tamper-evident. Application-controlled logs fail the CC7 evidence bar. The fix is architectural.

soc-2complianceai-governanceauditai-securitytrust-services
Read post →