EU AI Act Enforcement Roadmap: Deadlines and Compliance Tiers
Key enforcement dates, prohibited practices, General Purpose AI rules, and high-risk system obligations under EU Regulation 2024/1689.
LLMs in regulated environments
Using AI tools under GDPR, ISO 27001 and PCI DSS. What the DPAs actually say, what a lawful basis looks like, and where teams get caught out.
Do You Need a DPIA for an AI Tool? A Decision Framework
When GDPR Article 35 requires a Data Protection Impact Assessment for AI applications, and how to execute one systematically.
GDPR Lawful Basis for AI Tools at Work: A Compliance Guide
Evaluating Article 6 legal bases for deploying workplace AI tools under GDPR, covering consent, legitimate interests, and performance of a contract.
How to Get a DPA for an AI Tool, and What to Check in It
A buyer's guide to requesting, reviewing, and executing Data Processing Addendums with AI vendors under GDPR Article 28.
Prompt Logs and Data Subject Access Requests (DSAR)
How GDPR Article 15 access rights apply to AI prompt logs, vector database embeddings, and vendor abuse monitoring logs.
Shadow AI: Detecting and Managing Unapproved AI Tools
How to discover unauthorized AI browser extensions, web tools, and personal API keys operating within corporate environments.
Writing an AI Acceptable Use Policy That Staff Actually Follow
A practical framework for drafting actionable corporate AI usage policies, defining permitted data tiers, tool classes, and employee rules.
AI Vendor Security Questionnaire: Audit Checklist & Template
A practical evaluation template for security architects auditing AI vendors on data retention, sub-processors, and model training.
EU Data Residency for AI: Inference vs Storage
Understanding the critical compliance distinction between where prompts are stored and where AI model inference actually executes.
How to judge an AI provider, as EU enforcement begins
A ten-point framework for assessing OpenAI, Anthropic, Google and others on data governance, contractual commitments and AI Act readiness.
LLMs and PCI DSS: where cardholder data rules bite
PCI DSS has no AI requirement. It has something harder — a prohibition no risk analysis can waive, and a scope test an AI assistant has to survive.
Using LLMs under ISO 27001: the controls that apply
The Annex A controls an AI assistant actually touches, the clauses that come first, and the evidence your ISMS needs before an audit.