Framework summary, 2 min read
ISO/IEC 42001 makes AI governance auditable
ISO/IEC 42001 does not prescribe seven named documents; it requires controlled evidence that AI risks, responsibilities, and decisions are managed.
AI security
Tagged “ai”
13 pieces on this subject.
Framework summary, 2 min read
Secure AI agents by their traits, not their labels
The Cloud Security Alliance's trait-based approach maps agent behavior and architectural choices to concrete security risks and controls.
AI security
Essay, 4 min read
Why AI-assisted compliance review still needs a human signature
AI can read a marketing document against MiFID II requirements faster than any human. It still shouldn't be the one who approves it. That's a design principle, not a limitation.
Building CompylotAI
Framework summary, 2 min read
The OWASP AI Exchange connects AI threats to controls
The OWASP AI Exchange provides a lifecycle map for moving from AI governance and threat analysis to testing, operations, and residual-risk decisions.
AI security
Framework summary, 2 min read
Adversarial machine learning needs a common language
NIST's attack taxonomy helps security teams connect adversary goals, access, lifecycle stages, and mitigations across predictive and generative AI.
AI security
Framework summary, 2 min read
Red teaming generative AI is a lifecycle discipline
Microsoft's experience across 100 generative-AI products shows why testing must follow real system risks, not a generic attack checklist.
AI security
Framework summary, 2 min read
The OWASP LLM Top 10 is an application-security list
OWASP's 2025 list shows that securing an LLM application requires architecture, testing, and development controls around the model.
AI security
Framework summary, 2 min read
The EU AI Act turns AI governance into an operating obligation
The EU AI Act is not only a legal classification scheme; it requires organizations to connect AI risk, data governance, oversight, and evidence.
EU security and compliance
Framework summary, 2 min read
Managing generative-AI risk with the NIST profile
NIST's Generative AI Profile extends the AI RMF with concrete actions for governance, data provenance, testing, and incident disclosure.
AI security
Framework summary, 2 min read
AI security is governance in action
BaFin's central point is simple: AI security has to cover the whole decision process, not just the model.
AI security
Framework summary, 2 min read
Putting Google's Secure AI Framework into practice
Google's SAIF implementation guide turns six security principles into an organizational process for designing, deploying, and operating AI safely.
AI security
Framework summary, 2 min read
Google SAIF: six elements for secure AI
Google's one-page SAIF summary provides a useful executive test for whether AI security covers architecture, operations, and business risk.
AI security
Framework summary, 2 min read
NIST AI RMF: govern, map, measure, and manage
The NIST AI RMF gives organizations a lifecycle structure for connecting AI governance, assets, architecture, measurement, and risk treatment.
AI security
Get new pieces as they are published
Follow along wherever you read. No newsletter sign-up needed.