Generative AI Compliance

Generative AI systems, those that produce text, images, code, or other content in response to prompts, have introduced compliance challenges that sit outside most existing governance frameworks. They hallucinate facts, may reproduce training data in ways that raise copyright questions, and can be prompted to produce harmful content.

For compliance teams, the obligations depend on where generative AI is deployed: customer-facing products face different requirements than internal tools. The EU AI Act's GPAI provisions apply to foundation model providers. Multiple US states have passed or proposed disclosure requirements for AI-generated content. Copyright and data protection regulators in several jurisdictions are actively investigating training data practices.

This hub tracks the regulations, enforcement actions, and practitioner guidance shaping generative AI compliance.

3 items

GenAI in ITSM Deployments Require Formal Hallucination Controls and Access Governance, GSDC Guide Finds

The GSDC Council has published a practitioner guide on deploying generative AI within IT service management functions, covering governance and risk controls including access management, data privacy, hallucination detection, and compliance checks. The guide also recommends ongoing performance measurement to link AI governance to service outcomes. It is aimed at organizations operationalizing GenAI in ITSM contexts globally.

AI Governance Gaps Persist Across Global Enterprises, Cloud Security Alliance and Google Find

The Cloud Security Alliance, commissioned by Google, released 'The State of AI Security and Governance,' a data-driven research report examining how enterprises are adopting generative and agentic AI. The report documents significant gaps in AI governance maturity, security integration practices, and data exposure controls across global organizations. It also finds that multi-model AI strategies are concentrated among a small number of providers, and that security teams are among the earliest enterprise adopters of AI in cybersecurity workflows.

82% of Top 100 GenAI SaaS Tools Rated Medium to Critical Risk as Employees Routinely Enter Sensitive Data, Cyberhaven Labs Finds

Cyberhaven Labs released its 2026 AI Adoption and Risk Report on February 5, 2026, drawing on analysis of billions of real-world data movements across generative AI SaaS platforms, endpoint AI applications, and AI agents used in enterprise environments. The report finds that 82% of the top 100 GenAI SaaS tools are classified as medium to critical risk, and that employees are entering sensitive data into AI tools on average once every three days. A significant shadow IT dimension is documented: 32.3% of ChatGPT usage and 24.9% of Gemini usage occurs through personal accounts rather than corporate-managed accounts, placing that activity outside enterprise data governance controls. For compliance teams, the findings underscore a structural gap between the pace of AI adoption and the maturity of data loss prevention, acceptable use policies, and third-party risk management programs. Organizations lacking visibility into AI tool usage at the endpoint level may face exposure under data protection obligations in multiple jurisdictions, including the EU AI Act, various US state privacy laws, and sector-specific regulations governing sensitive data handling.