AI Governance & Compliance
The EU Cyber Resilience Act and AI Agent Products
How the EU Cyber Resilience Act's security-by-design, vulnerability handling, and reporting duties apply to AI agent software sold into the EU market.
AI Governance & Compliance
AI Governance & Compliance
Policies, audit trails, GDPR, and EU AI Act readiness for agentic AI.
Start here
AI Governance: The Complete Guide
The complete reference on AI governance: control points, guardrails, human-in-the-loop oversight, audit trails, and regulatory compliance for AI agents.
Read the guide →
AI Governance & Compliance
Governing Workday Agents Over HR Data
Workday's domain security model scopes agent access to HR data tightly, but integrations to external HRIS, payroll, and ATS systems fall outside it.
AI Governance & Compliance
Governing Snowflake Cortex Agents
Snowflake's RBAC and row-level policies govern Cortex Agents tightly inside the platform, but external functions and exports fall outside that perimeter.
AI Governance & Compliance
Governing SAP Joule Agents in Regulated Estates
Joule inherits SAP's authorization objects in-landscape, but regulated estates need an audit trail spanning any system a Joule agent reaches beyond SAP.
AI Governance & Compliance
Governing Microsoft 365 Copilot Agents
Copilot agents respect Microsoft Graph permissions by default, but citizen-developer publishing in Copilot Studio outpaces central inventory and review.
AI Governance & Compliance
Governing Agents on Databricks
Unity Catalog governs data and tool access tightly inside Databricks, but agents that reach outside it or span multi-cloud workspaces need separate controls.
AI Governance & Compliance
China's Agent Rules: A National Framework Built Around Agents, Not Models
China's Implementation Opinions regulate AI agents as their own category, not generative models, via a three-tier autonomy framework, as of late August 2026.
AI Governance & Compliance
Running Hermes Agent Under Governance: Tools, Memory, Skills
Hermes Agent ships a five-layer tool-use defense model, layered memory, and 40+ skills. A practitioner's guide to configuring it safely, not a feature tour.
AI Governance & Compliance
Classifying an AI Agent Under the EU AI Act's Risk Tiers
A step-by-step decision workflow for classifying an AI agent's EU AI Act risk tier — prohibited, high-risk Annex III, Article 50 transparency, or minimal risk.
AI Governance & Compliance
How to Write an AI Agent Acceptable Use Policy
The sections a usable AI agent acceptable use policy needs, why a chatbot AUP isn't enough, and a draft-to-review process for authoring one.
AI Governance & Compliance
Microsoft Agent Framework Is GA: Governance After the Merger
Microsoft Agent Framework went GA as the successor to AutoGen and Semantic Kernel. What its design choices — and its own disclaimers — mean for governance.
AI Governance & Compliance
n8n's AI Agent Node Is Core Infrastructure Now
n8n's AI Agent node bundles a model, memory, and tools into one node holding live credentials — and a CVSS-10 flaw showed exactly what that exposes.
AI Governance & Compliance
SOC 2 vs. ISO 42001 for AI Agent Programs: What Each One Actually Proves
SOC 2 is an attestation, ISO 42001 a certification — they prove different things about an AI agent program. A decision framework for which to pursue first.
AI Governance & Compliance
Does Your Cyber Insurance Cover What Your AI Agent Does?
Cyber policies largely cover attacks that use AI, not losses your own agents cause. The AI-agent coverage market is still forming as of August 2026.
AI Governance & Compliance
Agent Sprawl: 150,000 Agents Is a Governance Problem
Gartner projects 150,000+ agents per Fortune 500 enterprise by 2028, up from under 15 in 2025. Why sprawl is a different problem than shadow AI.
AI Governance & Compliance
EU AI Act Enforcement Is Live: What the AI Office Can Now Do
Since 2 August 2026, the EU AI Office can demand documentation, evaluate, restrict, and fine GPAI providers up to €15M or 3% of turnover, whichever is higher.
AI Governance & Compliance
NIST COSAiS: SP 800-53 Control Overlays for AI Agents
NIST's AI Agent Standards Initiative and COSAiS are drafting SP 800-53 control overlays for single- and multi-agent systems, as of August 2026.
AI Governance & Compliance
AI Governance Platform vs GRC Extension vs Control Plane
Disambiguating three product categories that all call themselves 'AI governance': GRC extensions, risk systems of record, and runtime control planes.
AI Governance & Compliance
The CSA AI Controls Matrix Explained
The Cloud Security Alliance's AI Controls Matrix maps AI risk to concrete controls across 18 domains, and lines up with ISO 42001 and NIST AI 600-1.
AI Governance & Compliance
ISO/IEC 42005 Explained: AI Impact Assessment vs DPIA
ISO/IEC 42005:2025 defines how to run an AI system impact assessment. Here is what it requires and how it differs from a DPIA or the EU AI Act's FRIA.
AI Governance & Compliance
DORA and AI Vendors: When ICT Third-Party Risk Applies
DORA has applied to EU financial entities since January 2025. Here is when an AI or LLM vendor counts as a regulated ICT third party under it.
AI Governance & Compliance
BYO KMS and Per-Tenant Signing Keys
Per-tenant signing keys held in a customer-controlled KMS change what a platform compromise can do and what a tenant can prove. Learn the substrate options, the trade-offs, and the operational cost.
AI Governance & Compliance
Public Agent Reputation and k-Anonymity
A public reputation lookup for agents leaks information unless it is designed carefully. Learn the anti-enumeration contract, why k-anonymity thresholds matter, and how reputation differs from trust.
AI Governance & Compliance
How to Audit AI Agent Activity
What to log for AI agents, how to keep audit trails credible and tamper-evident, and how to reconstruct any agent action for compliance or forensics.
AI Governance & Compliance
What FINRA and the SEC Expect From AI Agents in Finance
FINRA's 2026 oversight report and existing SEC rules set concrete expectations for AI agents at broker-dealers and RIAs — here is what they actually require.
AI Governance & Compliance
US State AI Laws Compared: SB 53, RAISE, TRAIGA, Colorado
California SB 53, New York's RAISE Act, Texas TRAIGA, and Colorado's amended AI Act target different companies — here is who actually has to comply.
AI Governance & Compliance
Governing AI Customer-Support Agents
Govern AI customer-support agents: PII detection, response guardrails, escalation triggers, and tamper-evident audit logs regulators expect.
AI Governance & Compliance
AI Agent Governance for Healthcare
How healthcare organizations protect PHI, enforce least privilege, and prove AI agent controls to satisfy HIPAA, the EU AI Act, and auditors.
AI Governance & Compliance
EU AI Act Article 50: Transparency Obligations for Engineers
Article 50 transparency obligations take effect 2 Aug 2026 — AI disclosure, synthetic-content marking, and what engineering teams must ship now.
AI Governance & Compliance
AI Agent Governance for Financial Services
The controls regulated financial firms need for AI agents: tamper-evident audit trails, scoped identity, approval gates, and on-demand regulatory evidence.
AI Governance & Compliance
The Colorado AI Act: A Compliance Guide for Engineers
Colorado SB 189 delayed the Colorado AI Act to January 1, 2027 and narrowed it to developer disclosure, consumer notice, and human-review duties.
AI Governance & Compliance
EU AI Act Digital Omnibus 2026: What Actually Changed
The EU AI Act Digital Omnibus entered into force 27 July 2026, deferring Annex III high-risk rules to Dec 2027 and Annex I to Aug 2028. Art. 49/50 unchanged.
AI Governance & Compliance
Guardrails vs Evals vs Monitoring
Guardrails, evals, and monitoring each close a different AI safety gap at a different lifecycle stage — learn how to use all three correctly.
AI Governance & Compliance
AI Agent Governance for Insurance
How insurers govern AI agents in underwriting and claims: consequential-decision controls, fairness monitoring, and exam-ready audit evidence.
AI Governance & Compliance
AI Agent Governance for the Legal Industry
How law firms and legal departments govern AI agents: privilege protection, matter-level access, ethical walls, and audit-ready evidence.
AI Governance & Compliance
AI Agent Governance for the Public Sector
How government organizations govern AI agents: citizen-facing decision controls, transparency-grade audit trails, sovereignty, and procurement.
AI Governance & Compliance
AI Guardrails vs LLM Firewall: Terms and Trade-offs
AI guardrails and LLM firewalls both inspect content but solve different problems. Learn the distinctions, evaluation approaches, and fail-mode trade-offs.
AI Governance & Compliance
Data Residency and Sovereignty for AI Agents
How to keep AI agent data within jurisdictional boundaries, satisfy GDPR and cross-border transfer rules, and produce the evidence regulators expect.
AI Governance & Compliance
ISO/IEC 42001 for AI Management Systems
ISO/IEC 42001 sets requirements for AI management systems. See what the standard expects and how agent governance controls map directly to its Annex A clauses.
AI Governance & Compliance
Agent Lifecycle Management: Draft to Production
Most agents go from a developer's laptop to production with no promotion gate. Learn the lifecycle stages worth defining, what each gate should check, and how to keep promotion fast enough to use.
AI Governance & Compliance
An AI Agent Compliance Checklist for 2026
A practical AI agent compliance checklist covering identity, tamper-evident audit trails, GDPR erasure, EU AI Act risk tiers, and vendor due diligence.
AI Governance & Compliance
Policy as Code: Versioning Guardrails and Agent Configuration
Guardrails and agent configuration are security controls, so they need the change discipline of security controls. Learn how to version policy, review changes, and prove which version was in force.
AI Governance & Compliance
A Glossary of AI Governance and Agent Security Terms
Precise definitions of AI governance and agent security terms — guardrail, control plane, A2A, attestation, trust score — for specs and vendor evaluations.
AI Governance & Compliance
Applying the NIST AI RMF to AI Agents
Apply the NIST AI RMF to AI agents: map GOVERN, MAP, MEASURE, and MANAGE to controls like agent inventories, threat models, audit trails, and revocation.
AI Governance & Compliance
An AI Governance Maturity Model
Five stages of AI governance maturity for agents, from ad-hoc to optimized, with concrete indicators and the specific work needed to advance each stage.
AI Governance & Compliance
Staged Guardrail Rollout and Shadow Mode
Enabling a guardrail in blocking mode without measuring it first is how teams end up disabling guardrails entirely. Learn the shadow-to-enforce progression and the metrics that justify each promotion.
AI Governance & Compliance
Maker-Checker for Platform Administration
Any administrative action a single person can both request and approve is not controlled. Learn where maker-checker belongs in an AI platform, how self-approval sneaks back in, and how to keep it usable.
AI Governance & Compliance
PII Detection and Redaction in AI Pipelines
Detect and redact PII before it reaches AI models or persists in logs — covering entry points, detection techniques, redaction strategies, and compliance.
AI Governance & Compliance
Designing Guardrails: Block, Redact, or Warn?
Choose the right enforcement action for AI agent guardrails — block, redact, or warn — and understand the fail-open vs fail-closed security trade-off.
AI Governance & Compliance
Audit Trails That Hold Up: Cryptographic Integrity
What makes an audit trail credible to an auditor or court: hash-chaining, per-row digital signatures, and external anchoring explained for engineering teams.
AI Governance & Compliance
How to Keep PII Out of Agent Prompts and Logs
Keep PII out of AI agent prompts, responses, and logs using detection-and-redaction controls that satisfy GDPR, HIPAA, and audit requirements.
AI Governance & Compliance
Governing Dify and Low-Code Agent Platforms
Low-code platforms like Dify let anyone assemble an agent with tool access in minutes. That speed is the governance problem, not a side effect of it.
AI Governance & Compliance
Texas TRAIGA: A Compliance Checklist for AI Operators
Texas's TRAIGA is already in force and applies broadly, with no size threshold — a practical checklist for teams operating AI agents that reach Texas users.
AI Governance & Compliance
PCI DSS and AI Agents Touching Cardholder Data
How PCI DSS's core requirements apply when an AI agent touches cardholder data, and the controls that keep it out of scope where possible.
AI Governance & Compliance
Human-in-the-Loop Approvals for High-Risk Agent Actions
Human-in-the-loop approvals pause AI agents before high-risk actions, preserve throughput with async queues, and build an auditable approval trail.
AI Governance & Compliance
NIS2 Obligations for AI Platform Operators
How the EU's NIS2 Directive's risk management, incident reporting, and supply-chain duties apply to organizations operating AI agent platforms.
AI Governance & Compliance
New York's RAISE Act: Obligations for Frontier AI Developers
New York's RAISE Act targets frontier-model developers with safety-framework and incident-reporting duties — who it reaches and what to build regardless.
AI Governance & Compliance
Illinois AI Employment Law and Hiring Agents
Illinois regulates AI in employment decisions and AI-analyzed video interviews — what hiring agents need to satisfy notice, bias, and human-review duties.
AI Governance & Compliance
HIPAA for AI Agents: Handling PHI Safely
How HIPAA's Security Rule and BAA requirements apply to AI agents that read, generate, or transmit protected health information.
AI Governance & Compliance
The GLBA Safeguards Rule Applied to AI Agents
How the GLBA Safeguards Rule's written information security program requirements apply when AI agents access customer financial data.
AI Governance & Compliance
FERPA and AI Agents in Education
How FERPA's consent, disclosure, and recordkeeping requirements apply when AI agents access student education records in K-12 or higher education.
AI Governance & Compliance
California SB 53 and Frontier AI Transparency, Explained
California's SB 53 requires frontier-model developers to publish safety frameworks and report incidents — here is the scope and the control work it implies.
AI Governance & Compliance
SOC 2 for AI Platforms: What Auditors Look For
SOC 2 auditors scrutinize AI platforms harder than traditional SaaS—learn which controls matter most, from tamper-evident audit trails to agent access.
AI Governance & Compliance
GDPR for AI Systems: Data Subject Rights and Erasure
How GDPR data subject rights apply to AI pipelines, what Article 17 erasure requires technically, and the design patterns that make compliance tractable.
AI Governance & Compliance
The EU AI Act Explained for Engineering Teams
EU AI Act for engineers after the 2026 Digital Omnibus: Annex III moves to Dec 2027, Art. 49/50 land 2 Aug 2026, plus a concrete readiness path.
AI Governance & Compliance
Building an AI Agent Inventory
How to discover, register, and maintain every AI agent you deploy — the foundational inventory that access policies, spend caps, and audit trails depend on.
AI Governance & Compliance
What Is AI Agent Governance?
AI agent governance defines the runtime controls — identity, authorization, guardrails, budgets, and audit trails — that keep autonomous agents accountable.
AI Governance & Compliance
UK AI Regulation: What Agent Operators Need to Know
The UK governs AI agents through existing sector regulators and cross-cutting principles, not a single AI Act — the control mapping operators need to prepare.
AI Governance & Compliance
AI Regulation in the UAE and Saudi Arabia for Agent Deployments
The UAE and Saudi Arabia govern AI agents through national strategy bodies, data-protection law, and free-zone rules rather than a single binding AI statute.
AI Governance & Compliance
Singapore's Model AI Governance Framework, Applied to Agents
Singapore governs AI through a voluntary framework and testing tools rather than binding law — the control mapping agent operators should build anyway.
AI Governance & Compliance
South Korea's AI Framework Act: A Compliance Primer
South Korea's AI Framework Act creates a binding risk-tiered regime for high-impact AI — the obligations agent operators should map to now.
AI Governance & Compliance
Japan's AI Law and Obligations for Agent Operators
Japan's AI law takes a light-touch, cooperation-based approach with no direct fines — here's what agent operators should still be able to prove.
AI Governance & Compliance
India's AI Governance Direction for Agent Deployments
India governs AI agents through advisories, sector regulators, and data-protection law rather than a binding AI statute — the control mapping to prepare now.
AI Governance & Compliance
Cross-Border Agent Compliance for Multinationals
A framework for governing AI agents across jurisdictions with different instrument types and sorting axes, built around one control set instead of ten.
AI Governance & Compliance
Canada's AI Regulation and Your Agent Program
Canada's proposed federal AI statute did not become law; here's how agent operators should govern deployments using existing privacy and sector rules instead.
AI Governance & Compliance
Brazil's AI Bill and What It Means for Agent Operators
Brazil's proposed AI bill would add EU-style risk tiers and rights to LGPD's existing data rules — the control mapping agent operators should build now.
AI Governance & Compliance
Australia's AI Safety Guidance for Agent Operators
Australia's Voluntary AI Safety Standard sets out guardrails agent operators should adopt now, ahead of proposed mandatory rules for high-risk AI.
AI Governance & Compliance
How to Build an AI Agent Risk Register
A step-by-step procedure for building an AI agent risk register, from identifying risk categories to assigning owners and a review cadence.
AI Governance & Compliance
AI Agent Governance for CISOs
What CISOs are accountable for as AI agents enter production, the questions they will be asked, and the artefacts they need to answer them.
AI Governance & Compliance
Change Management for Agent Configurations
Change management for agent configurations governs model, tool-scope, and budget edits with approval and audit, distinct from a canary or a policy cutover.
AI Governance & Compliance
Tamper-Evident Audit Logs with Cryptographic Proofs
Tamper-evident audit logs use hash-chaining and signed Merkle proofs to give compliance teams independently verifiable records—no platform access needed.
AI Governance & Compliance
GDPR and EU AI Act: A Combined Readiness Programme
How to run one readiness programme covering GDPR erasure and EU AI Act risk classification — shared controls, evidence collection, and the 2026-27 timeline.
AI Governance & Compliance
Tenant Isolation and Row-Level Security
How app-layer org scoping and database row-level security combine to prevent cross-tenant data leaks in multi-tenant AI platforms—and where each layer fits.
AI Governance & Compliance
Content Guardrails for AI Agents
How content guardrails enforce policy on every AI agent interaction—blocking, redacting, or escalating PII, secrets, and violations at the trust boundary.