AI Governance & Compliance
EU AI Act Article 12 Logging for AI Agents
What EU AI Act Article 12 record-keeping means for AI agents that call tools: the events to log, who keeps the logs under Articles 19 and 26(6), and how long.
AI Governance & Compliance
AI Governance & Compliance
Policies, audit trails, GDPR, and EU AI Act readiness for agentic AI systems.
Start here
AI Agent Governance: The Complete Guide (2026)
AI agent governance explained: control points, guardrails, human-in-the-loop oversight, audit trails, budgets, and the EU AI Act, NIST AI RMF and ISO 42001.
Read the guide →
AI Governance & Compliance
The EU Cyber Resilience Act and AI Agent Products
How the EU Cyber Resilience Act's security-by-design, vulnerability handling, and reporting duties apply to AI agent software sold into the EU market.
AI Governance & Compliance
Governing Workday Agents Over HR Data
Workday's domain security model scopes agent access to HR data tightly, but integrations to external HRIS, payroll, and ATS systems fall outside it.
AI Governance & Compliance
Governing Snowflake Cortex Agents
Snowflake's RBAC and row-level policies govern Cortex Agents tightly inside the platform, but external functions and exports fall outside that perimeter.
AI Governance & Compliance
Governing SAP Joule Agents in Regulated Estates
Joule inherits SAP's authorization objects in-landscape, but regulated estates need an audit trail spanning any system a Joule agent reaches beyond SAP.
AI Governance & Compliance
Governing Microsoft 365 Copilot Agents
Copilot agents respect Microsoft Graph permissions by default, but citizen-developer publishing in Copilot Studio outpaces central inventory and review.
AI Governance & Compliance
Governing Agents on Databricks
Unity Catalog governs data and tool access tightly inside Databricks, but agents that reach outside it or span multi-cloud workspaces need separate controls.
AI Governance & Compliance
China's Agent Rules: Built Around Agents, Not Models
China's Implementation Opinions regulate AI agents as their own category, not generative models, via a three-tier autonomy framework, as of late August 2026.
AI Governance & Compliance
Running Hermes Agent Under Governance: Tools, Memory, Skills
Hermes Agent ships a five-layer tool-use defense model, layered memory, and 40+ skills. A practitioner's guide to configuring it safely, not a feature tour.
AI Governance & Compliance
Classifying an AI Agent Under the EU AI Act's Risk Tiers
A step-by-step decision workflow for classifying an AI agent's EU AI Act risk tier — prohibited, high-risk Annex III, Article 50 transparency, or minimal risk.
AI Governance & Compliance
How to Write an AI Agent Acceptable Use Policy
The sections a usable AI agent acceptable use policy needs, why a chatbot AUP isn't enough, and a draft-to-review process for authoring one.
AI Governance & Compliance
Microsoft Agent Framework Is GA: Governance After the Merger
Microsoft Agent Framework went GA as the successor to AutoGen and Semantic Kernel. What its design choices — and its own disclaimers — mean for governance.
AI Governance & Compliance
n8n's AI Agent Node Is Core Infrastructure Now
n8n's AI Agent node bundles a model, memory, and tools into one node holding live credentials — and a CVSS-10 flaw showed exactly what that exposes.
AI Governance & Compliance
SOC 2 vs. ISO 42001 for AI Agents: What Each One Proves
SOC 2 is an attestation, ISO 42001 a certification — they prove different things about an AI agent program. A decision framework for which to pursue first.
AI Governance & Compliance
Governing Atlassian Rovo Agents
Rovo agents inherit Jira and Confluence permissions by default, but Forge-based extensibility and third-party connectors create a separate control surface.
AI Governance & Compliance
Does Your Cyber Insurance Cover What Your AI Agent Does?
Cyber policies largely cover attacks that use AI, not losses your own agents cause. The AI-agent coverage market is still forming as of August 2026.
AI Governance & Compliance
Agent Sprawl: 150,000 Agents Is a Governance Problem
Gartner projects 150,000+ agents per Fortune 500 enterprise by 2028, up from under 15 in 2025. Why sprawl is a different problem than shadow AI.
AI Governance & Compliance
EU AI Act Enforcement Is Live: What the AI Office Can Now Do
Since 2 August 2026, the EU AI Office can demand documentation, evaluate, restrict, and fine GPAI providers up to €15M or 3% of turnover, whichever is higher.
AI Governance & Compliance
NIST COSAiS: SP 800-53 Control Overlays for AI Agents
NIST's AI Agent Standards Initiative and COSAiS are drafting SP 800-53 control overlays for single- and multi-agent systems, as of August 2026.
AI Governance & Compliance
AI Governance Platform vs GRC Extension vs Control Plane
Disambiguating three product categories that all call themselves 'AI governance': GRC extensions, risk systems of record, and runtime control planes.
AI Governance & Compliance
The CSA AI Controls Matrix Explained
The Cloud Security Alliance's AI Controls Matrix maps AI risk to concrete controls across 18 domains, and lines up with ISO 42001 and NIST AI 600-1.
AI Governance & Compliance
ISO/IEC 42005 Explained: AI Impact Assessment vs DPIA
ISO/IEC 42005:2025 defines how to run an AI system impact assessment. Here is what it requires and how it differs from a DPIA or the EU AI Act's FRIA.
AI Governance & Compliance
DORA and AI Vendors: When ICT Third-Party Risk Applies
DORA has applied to EU financial entities since January 2025. Here is when an AI or LLM vendor counts as a regulated ICT third party under it.
AI Governance & Compliance
BYO KMS and Per-Tenant Signing Keys
Per-tenant signing keys in a customer-controlled KMS change what a platform compromise can do and what a tenant can prove. The options, trade-offs, and cost.
AI Governance & Compliance
Public Agent Reputation and k-Anonymity
A public agent reputation lookup leaks information unless designed carefully. The anti-enumeration contract, k-anonymity thresholds, and reputation vs. trust.
AI Governance & Compliance
How to Audit AI Agent Activity: A Step-by-Step Process
A step-by-step process for auditing AI agent activity: what to log at each layer, how to reconstruct one agent action, and how to export evidence.
AI Governance & Compliance
What FINRA and the SEC Expect From AI Agents in Finance
FINRA's 2026 oversight report and existing SEC rules set concrete expectations for AI agents at broker-dealers and RIAs — here is what they actually require.
AI Governance & Compliance
US State AI Laws Compared: SB 53, RAISE, TRAIGA, Colorado
California SB 53, New York's RAISE Act, Texas TRAIGA, and Colorado's amended AI Act target different companies — here is who actually has to comply.
AI Governance & Compliance
Governing AI Customer-Support Agents
Govern AI customer-support agents: PII detection, response guardrails, escalation triggers, and tamper-evident audit logs regulators expect.
AI Governance & Compliance
HIPAA and the EU AI Act for Healthcare AI Agents
What HIPAA and the EU AI Act ask of AI agents that touch PHI: minimum-necessary access, audit controls, risk classification and the evidence to keep.
AI Governance & Compliance
EU AI Act Article 50: Transparency Obligations for Engineers
Article 50 transparency obligations apply from 2 Aug 2026 — AI disclosure, synthetic-content marking, and what engineering teams must ship now.
AI Governance & Compliance
Financial Services AI Agents: EU AI Act and GDPR Rules
What regulators expect of AI agents in banking and finance: EU AI Act high-risk uses such as credit scoring, GDPR duties, attributable actions and evidence.
AI Governance & Compliance
The Colorado AI Act: A Compliance Guide for Engineers
Colorado SB 189 delayed the Colorado AI Act to January 1, 2027 and narrowed it to developer disclosure, consumer notice, and human-review duties.
AI Governance & Compliance
EU AI Act Digital Omnibus 2026: What Actually Changed
The EU AI Act Digital Omnibus, in force since 27 July 2026, defers Annex III high-risk rules to Dec 2027 and Annex I to Aug 2028. Art. 50 applies from Aug 2026.
AI Governance & Compliance
Guardrails vs Evals vs Monitoring: Which Control When
Guardrails, evals and monitoring each close a different AI safety gap at a different lifecycle stage. Which one to use when, and why you need all three.
AI Governance & Compliance
Insurance AI Agents: Colorado AI Act, EU AI Act and NAIC
What insurers deploying AI agents in underwriting and claims must meet: the Colorado AI Act, EU AI Act high-risk rules and the NAIC model bulletin.
AI Governance & Compliance
AI Agent Governance for the Legal Industry
How law firms and legal departments govern AI agents: privilege protection, matter-level access, ethical walls, and audit-ready evidence.
AI Governance & Compliance
EU AI Act Rules for Public-Sector AI Agents
What public bodies deploying AI agents must meet under the EU AI Act and administrative law: high-risk uses, transparency, registration and human review.
AI Governance & Compliance
AI Guardrails vs LLM Firewall: Terms and Trade-offs
AI guardrails and LLM firewalls both inspect content but solve different problems. Learn the distinctions, evaluation approaches, and fail-mode trade-offs.
AI Governance & Compliance
Data Residency and Sovereignty for AI Agents
How to keep AI agent data within jurisdictional boundaries, satisfy GDPR and cross-border transfer rules, and produce the evidence regulators expect.
AI Governance & Compliance
ISO/IEC 42001 for AI Management Systems
ISO/IEC 42001 sets requirements for AI management systems. See what the standard expects and how agent governance controls map directly to its Annex A clauses.
AI Governance & Compliance
Agent Lifecycle Management: Draft to Production
Most agents reach production with no promotion gate. The lifecycle stages worth defining, what each gate should check, and how to keep promotion fast.
AI Governance & Compliance
An AI Agent Compliance Checklist for 2026
A practical AI agent compliance checklist covering identity, tamper-evident audit trails, GDPR erasure, EU AI Act risk tiers, and vendor due diligence.
AI Governance & Compliance
Policy as Code: Versioning Guardrails and Agent Config
Guardrails and agent configuration are security controls and need their change discipline: version policy, review changes, prove which version was in force.
AI Governance & Compliance
Applying the NIST AI RMF to AI Agents
Apply the NIST AI RMF to AI agents: map GOVERN, MAP, MEASURE, and MANAGE to controls like agent inventories, threat models, audit trails, and revocation.
AI Governance & Compliance
An AI Governance Maturity Model
Five stages of AI governance maturity for agents, from ad-hoc to optimized, with concrete indicators and the specific work needed to advance each stage.
AI Governance & Compliance
Staged Guardrail Rollout and Shadow Mode
Blocking with an unmeasured guardrail is how teams end up disabling guardrails. The shadow-to-enforce progression and the metrics that justify each promotion.
AI Governance & Compliance
Maker-Checker for Platform Administration
An admin action one person can both request and approve is not controlled. Where maker-checker belongs in an AI platform and how self-approval sneaks back in.
AI Governance & Compliance
PII Detection and Redaction in AI Pipelines
Detect and redact PII before it reaches AI models or persists in logs — covering entry points, detection techniques, redaction strategies, and compliance.
AI Governance & Compliance
Designing Guardrails: Block, Redact, or Warn?
Choose the right enforcement action for AI agent guardrails — block, redact, or warn — and understand the fail-open vs fail-closed security trade-off.
AI Governance & Compliance
How to Keep PII Out of Agent Prompts and Logs
Keep PII out of AI agent prompts, responses, and logs using detection-and-redaction controls that satisfy GDPR, HIPAA, and audit requirements.
AI Governance & Compliance
Governing Dify and Low-Code Agent Platforms
Low-code platforms like Dify let anyone assemble an agent with tool access in minutes. That speed is the governance problem, not a side effect of it.
AI Governance & Compliance
Texas TRAIGA: A Compliance Checklist for AI Operators
Texas's TRAIGA is already in force and applies broadly, with no size threshold — a practical checklist for teams operating AI agents that reach Texas users.
AI Governance & Compliance
PCI DSS and AI Agents Touching Cardholder Data
How PCI DSS's core requirements apply when an AI agent touches cardholder data, and the controls that keep it out of scope where possible.
AI Governance & Compliance
Human-in-the-Loop Approvals for High-Risk Agent Actions
Human-in-the-loop approvals pause AI agents before high-risk actions, preserve throughput with async queues, and build an auditable approval trail.
AI Governance & Compliance
NIS2 Obligations for AI Platform Operators
How the EU's NIS2 Directive's risk management, incident reporting, and supply-chain duties apply to organizations operating AI agent platforms.
AI Governance & Compliance
New York's RAISE Act: Obligations for Frontier AI Developers
New York's RAISE Act targets frontier-model developers with safety-framework and incident-reporting duties — who it reaches and what to build regardless.
AI Governance & Compliance
Illinois AI Employment Law and Hiring Agents
Illinois regulates AI in employment decisions and AI-analyzed video interviews — what hiring agents need to satisfy notice, bias, and human-review duties.
AI Governance & Compliance
HIPAA for AI Agents: Handling PHI Safely
How HIPAA's Security Rule and BAA requirements apply to AI agents that read, generate, or transmit protected health information.
AI Governance & Compliance
The GLBA Safeguards Rule Applied to AI Agents
How the GLBA Safeguards Rule's written information security program requirements apply when AI agents access customer financial data.
AI Governance & Compliance
FERPA and AI Agents in Education
How FERPA's consent, disclosure, and recordkeeping requirements apply when AI agents access student education records in K-12 or higher education.
AI Governance & Compliance
California SB 53 and Frontier AI Transparency, Explained
California's SB 53 requires frontier-model developers to publish safety frameworks and report incidents — here is the scope and the control work it implies.
AI Governance & Compliance
SOC 2 for AI Platforms: What Auditors Look For
SOC 2 auditors scrutinize AI platforms harder than traditional SaaS—learn which controls matter most, from tamper-evident audit trails to agent access.
AI Governance & Compliance
GDPR for AI Systems: Data Subject Rights and Erasure
How GDPR data subject rights apply to AI pipelines, what Article 17 erasure requires technically, and the design patterns that make compliance tractable.
AI Governance & Compliance
The EU AI Act Explained for Engineering Teams
EU AI Act for engineers after the 2026 Digital Omnibus: Annex III high-risk rules move to Dec 2027, Art. 50 applies from Aug 2026, plus a readiness path.
AI Governance & Compliance
How to Discover AI Agents: Methods Compared
How to discover the AI agents you run, compared: registration, repository scans, telemetry, access logs, consoles and surveys, and what each one misses.
AI Governance & Compliance
AI Agent Governance vs Model Governance: What Differs
How AI agent governance differs from model governance: runtime controls on what a deployed agent may do, versus checks on the model itself.
AI Governance & Compliance
UK AI Regulation: What Agent Operators Need to Know
The UK governs AI agents through existing sector regulators and cross-cutting principles, not a single AI Act — the control mapping operators need to prepare.
AI Governance & Compliance
AI Regulation in the UAE and Saudi Arabia for AI Agents
The UAE and Saudi Arabia govern AI agents through national strategy bodies, data-protection law, and free-zone rules rather than a single binding AI statute.
AI Governance & Compliance
Singapore's Model AI Governance Framework, Applied to Agents
Singapore governs AI through a voluntary framework and testing tools rather than binding law — the control mapping agent operators should build anyway.
AI Governance & Compliance
South Korea's AI Framework Act: A Compliance Primer
South Korea's AI Framework Act creates a binding risk-tiered regime for high-impact AI — the obligations agent operators should map to now.
AI Governance & Compliance
Japan's AI Law and Obligations for Agent Operators
Japan's AI law takes a light-touch, cooperation-based approach with no direct fines — here's what agent operators should still be able to prove.
AI Governance & Compliance
India's AI Governance Direction for Agent Deployments
India governs AI agents through advisories, sector regulators, and data-protection law rather than a binding AI statute — the control mapping to prepare now.
AI Governance & Compliance
Cross-Border Agent Compliance for Multinationals
A framework for governing AI agents across jurisdictions with different instrument types and sorting axes, built around one control set instead of ten.
AI Governance & Compliance
Canada's AI Regulation and Your Agent Program
Canada's proposed federal AI statute did not become law; here's how agent operators should govern deployments using existing privacy and sector rules instead.
AI Governance & Compliance
Brazil's AI Bill and What It Means for Agent Operators
Brazil's proposed AI bill would add EU-style risk tiers and rights to LGPD's existing data rules — the control mapping agent operators should build now.
AI Governance & Compliance
Australia's AI Safety Guidance for Agent Operators
Australia's Voluntary AI Safety Standard sets out guardrails agent operators should adopt now, ahead of proposed mandatory rules for high-risk AI.
AI Governance & Compliance
How to Build an AI Agent Risk Register
A step-by-step procedure for building an AI agent risk register, from identifying risk categories to assigning owners and a review cadence.
AI Governance & Compliance
AI Agent Governance for CISOs
What CISOs are accountable for as AI agents enter production, the questions they will be asked, and the artefacts they need to answer them.
AI Governance & Compliance
Change Management for Agent Configurations
Change management for agent configurations governs model, tool-scope, and budget edits with approval and audit, distinct from a canary or a policy cutover.
AI Governance & Compliance
Tamper-Evident Audit Logs with Cryptographic Proofs
Tamper-evident audit logs use hash-chaining and signed Merkle proofs to give compliance teams independently verifiable records—no platform access needed.
AI Governance & Compliance
GDPR and EU AI Act: A Combined Readiness Programme
How to run one readiness programme covering GDPR erasure and EU AI Act risk classification — shared controls, evidence collection, and the 2026-27 timeline.
AI Governance & Compliance
Tenant Isolation and Row-Level Security
How app-layer org scoping and database row-level security combine to prevent cross-tenant data leaks in multi-tenant AI platforms—and where each layer fits.
AI Governance & Compliance
Content Guardrails for AI Agents
How content guardrails enforce policy on every AI agent interaction—blocking, redacting, or escalating PII, secrets, and violations at the trust boundary.