AI Governance & Compliance
AI Governance Platform vs GRC Extension vs Control Plane
Disambiguating three product categories that all call themselves 'AI governance': GRC extensions, risk systems of record, and runtime control planes.
AI Governance & Compliance
AI Governance & Compliance
Policies, audit trails, GDPR, and EU AI Act readiness for agentic AI.
Start here
AI Governance: The Complete Guide
The complete reference on AI governance: control points, guardrails, human-in-the-loop oversight, audit trails, and regulatory compliance for AI agents.
Read the guide →
AI Governance & Compliance
The CSA AI Controls Matrix Explained
The Cloud Security Alliance's AI Controls Matrix maps AI risk to concrete controls across 18 domains, and lines up with ISO 42001 and NIST AI 600-1.
AI Governance & Compliance
ISO/IEC 42005 Explained: AI Impact Assessment vs DPIA
ISO/IEC 42005:2025 defines how to run an AI system impact assessment. Here is what it requires and how it differs from a DPIA or the EU AI Act's FRIA.
AI Governance & Compliance
DORA and AI Vendors: When ICT Third-Party Risk Applies
DORA has applied to EU financial entities since January 2025. Here is when an AI or LLM vendor counts as a regulated ICT third party under it.
AI Governance & Compliance
BYO KMS and Per-Tenant Signing Keys
Per-tenant signing keys held in a customer-controlled KMS change what a platform compromise can do and what a tenant can prove. Learn the substrate options, the trade-offs, and the operational cost.
AI Governance & Compliance
Public Agent Reputation and k-Anonymity
A public reputation lookup for agents leaks information unless it is designed carefully. Learn the anti-enumeration contract, why k-anonymity thresholds matter, and how reputation differs from trust.
AI Governance & Compliance
How to Audit AI Agent Activity
What to log for AI agents, how to keep audit trails credible and tamper-evident, and how to reconstruct any agent action for compliance or forensics.
AI Governance & Compliance
What FINRA and the SEC Expect From AI Agents in Finance
FINRA's 2026 oversight report and existing SEC rules set concrete expectations for AI agents at broker-dealers and RIAs — here is what they actually require.
AI Governance & Compliance
US State AI Laws Compared: SB 53, RAISE, TRAIGA, Colorado
California SB 53, New York's RAISE Act, Texas TRAIGA, and Colorado's amended AI Act target different companies — here is who actually has to comply.
AI Governance & Compliance
Governing AI Customer-Support Agents
Govern AI customer-support agents: PII detection, response guardrails, escalation triggers, and tamper-evident audit logs regulators expect.
AI Governance & Compliance
AI Agent Governance for Healthcare
How healthcare organizations protect PHI, enforce least privilege, and prove AI agent controls to satisfy HIPAA, the EU AI Act, and auditors.
AI Governance & Compliance
EU AI Act Article 50: Transparency Obligations for Engineers
Article 50 transparency obligations take effect 2 Aug 2026 — AI disclosure, synthetic-content marking, and what engineering teams must ship now.
AI Governance & Compliance
AI Agent Governance for Financial Services
The controls regulated financial firms need for AI agents: tamper-evident audit trails, scoped identity, approval gates, and on-demand regulatory evidence.
AI Governance & Compliance
The Colorado AI Act: A Compliance Guide for Engineers
Colorado SB 189 delayed the Colorado AI Act to January 1, 2027 and narrowed it to developer disclosure, consumer notice, and human-review duties.
AI Governance & Compliance
EU AI Act Digital Omnibus 2026: What Actually Changed
The EU AI Act Digital Omnibus entered into force 27 July 2026, deferring Annex III high-risk rules to Dec 2027 and Annex I to Aug 2028. Art. 49/50 unchanged.
AI Governance & Compliance
Guardrails vs Evals vs Monitoring
Guardrails, evals, and monitoring each close a different AI safety gap at a different lifecycle stage — learn how to use all three correctly.
AI Governance & Compliance
AI Agent Governance for Insurance
How insurers govern AI agents in underwriting and claims: consequential-decision controls, fairness monitoring, and exam-ready audit evidence.
AI Governance & Compliance
AI Agent Governance for the Legal Industry
How law firms and legal departments govern AI agents: privilege protection, matter-level access, ethical walls, and audit-ready evidence.
AI Governance & Compliance
AI Agent Governance for the Public Sector
How government organizations govern AI agents: citizen-facing decision controls, transparency-grade audit trails, sovereignty, and procurement.
AI Governance & Compliance
AI Guardrails vs LLM Firewall: Terms and Trade-offs
AI guardrails and LLM firewalls both inspect content but solve different problems. Learn the distinctions, evaluation approaches, and fail-mode trade-offs.
AI Governance & Compliance
Data Residency and Sovereignty for AI Agents
How to keep AI agent data within jurisdictional boundaries, satisfy GDPR and cross-border transfer rules, and produce the evidence regulators expect.
AI Governance & Compliance
ISO/IEC 42001 for AI Management Systems
ISO/IEC 42001 sets requirements for AI management systems. See what the standard expects and how agent governance controls map directly to its Annex A clauses.
AI Governance & Compliance
Agent Lifecycle Management: Draft to Production
Most agents go from a developer's laptop to production with no promotion gate. Learn the lifecycle stages worth defining, what each gate should check, and how to keep promotion fast enough to use.
AI Governance & Compliance
An AI Agent Compliance Checklist for 2026
A practical AI agent compliance checklist covering identity, tamper-evident audit trails, GDPR erasure, EU AI Act risk tiers, and vendor due diligence.
AI Governance & Compliance
Policy as Code: Versioning Guardrails and Agent Configuration
Guardrails and agent configuration are security controls, so they need the change discipline of security controls. Learn how to version policy, review changes, and prove which version was in force.
AI Governance & Compliance
A Glossary of AI Governance and Agent Security Terms
Precise definitions of AI governance and agent security terms — guardrail, control plane, A2A, attestation, trust score — for specs and vendor evaluations.
AI Governance & Compliance
Applying the NIST AI RMF to AI Agents
Apply the NIST AI RMF to AI agents: map GOVERN, MAP, MEASURE, and MANAGE to controls like agent inventories, threat models, audit trails, and revocation.
AI Governance & Compliance
An AI Governance Maturity Model
Five stages of AI governance maturity for agents, from ad-hoc to optimized, with concrete indicators and the specific work needed to advance each stage.
AI Governance & Compliance
Staged Guardrail Rollout and Shadow Mode
Enabling a guardrail in blocking mode without measuring it first is how teams end up disabling guardrails entirely. Learn the shadow-to-enforce progression and the metrics that justify each promotion.
AI Governance & Compliance
Maker-Checker for Platform Administration
Any administrative action a single person can both request and approve is not controlled. Learn where maker-checker belongs in an AI platform, how self-approval sneaks back in, and how to keep it usable.
AI Governance & Compliance
PII Detection and Redaction in AI Pipelines
Detect and redact PII before it reaches AI models or persists in logs — covering entry points, detection techniques, redaction strategies, and compliance.
AI Governance & Compliance
Designing Guardrails: Block, Redact, or Warn?
Choose the right enforcement action for AI agent guardrails — block, redact, or warn — and understand the fail-open vs fail-closed security trade-off.
AI Governance & Compliance
Audit Trails That Hold Up: Cryptographic Integrity
What makes an audit trail credible to an auditor or court: hash-chaining, per-row digital signatures, and external anchoring explained for engineering teams.
AI Governance & Compliance
How to Keep PII Out of Agent Prompts and Logs
Keep PII out of AI agent prompts, responses, and logs using detection-and-redaction controls that satisfy GDPR, HIPAA, and audit requirements.
AI Governance & Compliance
Human-in-the-Loop Approvals for High-Risk Agent Actions
Human-in-the-loop approvals pause AI agents before high-risk actions, preserve throughput with async queues, and build an auditable approval trail.
AI Governance & Compliance
SOC 2 for AI Platforms: What Auditors Look For
SOC 2 auditors scrutinize AI platforms harder than traditional SaaS—learn which controls matter most, from tamper-evident audit trails to agent access.
AI Governance & Compliance
GDPR for AI Systems: Data Subject Rights and Erasure
How GDPR data subject rights apply to AI pipelines, what Article 17 erasure requires technically, and the design patterns that make compliance tractable.
AI Governance & Compliance
The EU AI Act Explained for Engineering Teams
EU AI Act for engineers after the 2026 Digital Omnibus: Annex III moves to Dec 2027, Art. 49/50 land 2 Aug 2026, plus a concrete readiness path.
AI Governance & Compliance
Building an AI Agent Inventory
How to discover, register, and maintain every AI agent you deploy — the foundational inventory that access policies, spend caps, and audit trails depend on.
AI Governance & Compliance
What Is AI Agent Governance?
AI agent governance defines the runtime controls — identity, authorization, guardrails, budgets, and audit trails — that keep autonomous agents accountable.
AI Governance & Compliance
Tamper-Evident Audit Logs with Cryptographic Proofs
Tamper-evident audit logs use hash-chaining and signed Merkle proofs to give compliance teams independently verifiable records—no platform access needed.
AI Governance & Compliance
GDPR and EU AI Act: A Combined Readiness Programme
How to run one readiness programme covering GDPR erasure and EU AI Act risk classification — shared controls, evidence collection, and the 2026-27 timeline.
AI Governance & Compliance
Tenant Isolation and Row-Level Security
How app-layer org scoping and database row-level security combine to prevent cross-tenant data leaks in multi-tenant AI platforms—and where each layer fits.
AI Governance & Compliance
Content Guardrails for AI Agents
How content guardrails enforce policy on every AI agent interaction—blocking, redacting, or escalating PII, secrets, and violations at the trust boundary.