Recent posts tagged compliance

> This article was originally published on korixinc.comhttps://korixinc.com/learning-center/ai-policy-template-uk. > Read the canonical version at: Free AI Policy Template UK: Every Rule Has a Control A policy is only as strong as the control behi...

title: "SOC 2, CRA, NIS2: they all ask your cluster the same five questions" published: true description: "A working engineer's read of SOC 2 and the EU instruments that landed alongside it, and why the hard part is not the controls but the evidence...

GPT-6 Astra is disabled by default in ChatGPT Business and Enterprise. An owner must turn it on. It is worth enabling for most teams, but three things changed that your AI policy probably does not cover: it is the first OpenAI model at the Critical c...

The state Comptroller found two complaints in twenty-four months. Cornell's team found 14 audit reports among 267 employers. Both measurements hit the same wall: a disclosure rule whose scope is set by the discloser produces a record that cannot tell...

When you author policies in Rego to be evaluated by Open Policy Agent OPA, there are a whole heap of patterns you can use to make policies correct, safe, predictable, and maintainable. You could write a whole book on this topic, and along with John B...

Security review is not the exciting part of an AI chatbot project. It is often the part that gets rushed under deadline pressure, and it is exactly the part that should never be rushed. A single governance gap can turn a promising deployment into a ...

The tool worked. That was never the problem. A business manager had specced it with AI, straight from the business need, and the result did what he asked: it ran, it produced output, it looked finished. What it did not have was a single log line. No ...

In this episode of Continuous Delivery Office Hours, Steve Fenton is joined by Octopus Deploy founder Paul Stovell to explore the hidden bottleneck in the AI productivity conversation that nobody is talking about: compliance and risk tolerance. Ever...

The EU AI Act isn't just incoming regulation - it classifies AI systems by risk and sorts what you're required to build, document, and prove before you ship. The Risk Tier System and What It Requires The Act sorts AI systems into four risk tiers: u...

In this episode of Continuous Delivery Office Hours, Tony Kelly, Bob Walker, and Steve Fenton discuss the purpose and common pitfalls of software change approvals. They argue that strict, manual change approval processes are often just a reflex to pa...

The demo went well. The model answered correctly, the stakeholders nodded, someone said "let's get this into production." That was six months ago. The PoC still runs, the roadmap still lists it, and it is no closer to shipping than it was on demo day...

If you're building AI agents and trying to sell into enterprise, you've probably hit the wall: the 40-page security questionnaire that asks about logging, access control, data residency, and adversarial testing - none of which you thought about while...

2,667 startup ideas — and my AI engine kept coming back to the same niche 23 times Since EvoRadar went live, the engine has been doing three things on autopilot: scanning global signals, generating startup ideas, and killing the ones that aren’t str...

TL;DR: Audited 276 websites and found that 95.65% of them had Cookie Banner proxy checks installed and 99.62% of bannered sites have pre-consent third‑party tracker signals still flagged by runtime audit engine. In other words: banner presence was ...

> ### TL;DR > You can ship a small first-party consent module fast AI helps. The > part that actually holds up under scrutiny is whether non-essential > requests and scripts stay dead until valid consent in a real > browser. Treat a runtime audit lik...

Compliance as an engineering problem: building an open-source Information Security, Privacy and AI Governance Platform There are two kinds of compliance tooling on the market. The first is a spreadsheet dressed in good intentions. The second is a c...

The Zurich Case: Operational Success vs. Compliance Architecture !https://coderlegion.com/?qa=blob&qablobid=2452803590136326558 A clinician in Zurich recently watched a short video explaining how easy it now is to build software with AI. The messag...

"The Story" "Why DAIS‑10 Exists Every organization begins with clean, fresh customer records, accurate details, and the belief that this information will guide smart decisions. But over time, something quiet and destructive happens behind the scene...

Last week, we looked at and listened to the symphony of dynamic webpage content. If Session 1 was the quiet theory of Section 508, Session 2 was the loud, blinking, scrolling reality of the web. We tackled the trio of auto-playing audio, moving/blink...