20 posts on industry verticals.
Heads of Security own the production controls that prevent damage at machine speed. AI traffic is the data channel where the controls have to operate. The Mandiant 22-second handoff window and the IBM shadow AI numbers determine what counts as a working control today.
AI platform leads operate the gateway, the model registry, the eval pipeline, and the identity plumbing that production AI runs on. The choice of an enforcement layer at the AI request boundary determines whether security and compliance are absorbed by the platform or pushed onto feature teams.
AI platform engineers operate the gateway, the model routing, the identity plumbing, and the eval pipeline that production AI runs on. Adding inline enforcement and per-decision audit at the request boundary determines whether the platform can absorb the security and compliance asks.
B2B SaaS founders shipping AI features face a new gate in every enterprise sales cycle: the AI security questionnaire. The questions trace back to specific regulations the customer is subject to (EU AI Act, HIPAA, SOC 2, DORA) and ask whether the SaaS product produces evidence the customer can use in its own audit. This piece walks through the seven questions that appear most often, what the answer has to demonstrate architecturally, and where most AI features fall short.
AI compliance officers are accountable for evidence that survives a regulatory review. EU AI Act Article 12, Fannie Mae LL-2026-04, NIST AI RMF, and HIPAA each require per-decision records of AI activity, independent of the application that made the decision.
DORA took effect January 2025 across the EU financial sector and overlaps with the EU AI Act on the high-risk AI systems banks operate. The combined obligation includes operational resilience, third-party risk management, incident reporting, and per-decision audit records for AI-assisted financial decisions. This piece walks through what DORA actually requires of AI systems, how Article 6 and Annex III of the EU AI Act layer on top, and the architecture that satisfies both.
Cloud Radix reports that 57% of healthcare professionals use unauthorized AI to process PHI without a Business Associate Agreement. The HHS Office for Civil Rights treats unauthorized PHI disclosure as a breach regardless of intent. This piece walks through what HIPAA actually requires for AI processing of PHI, where most healthcare AI deployments are exposed, and the inspection architecture that produces the access logs and access controls HIPAA expects.
CISOs are accountable for AI risk in front of boards that ask for specific numbers, specific incidents, and specific evidence. The post-authentication gap, the self-attestation problem, and the inline enforcement requirement are the three architectural facts that shape the answer.