How to run AI governance at scale
A practical guide for compliance officers, general counsel, GRC teams, and risk managers navigating the operational realities of enterprise AI governance. Questions every compliance team needs to answer.
Not sure where to start? Answer 3 questions and get a tailored compliance action plan.
What applies to me? →How do we maintain data privacy compliance when using AI?
Addressing training data sourcing, data minimization, cross-border transfers, and the right to explanation under GDPR and CCPA.
Is our training data compliant with global privacy laws?
Ensuring you had the right to use data for model training, identifying PII in datasets, and navigating GDPR and EU AI Act data obligations.
Is our AI red-teaming rigorous enough?
Defining pass/fail criteria for adversarial testing of high-risk AI systems before deployment, covering toxicity, data leakage, jailbreaking, and misuse scenarios.
How do we govern AI agents that take autonomous actions?
Agentic AI systems that can browse the web, execute code, send messages, and interact with external services require governance controls that traditional policy frameworks were never designed to handle.
How do we audit an AI system for compliance?
A methodology for conducting compliance audits of individual AI systems — what to review, what evidence to collect, and how to write findings that actually drive remediation.
How do we intake and govern open-weight and self-hosted AI models?
A governance framework for organizations that download, fine-tune, or self-host open-weight models — covering intake review, deployment controls, and ongoing maintenance obligations that differ from API-based vendor relationships.
How do we govern our AI supply chain and manage upstream model dependencies?
A governance framework for managing the risks introduced by upstream AI dependencies — foundation models, third-party datasets, AI-enabled development tools, and compute infrastructure — as components of the organization's AI supply chain.
New guidance, every week
We publish practical guidance as governance questions come up in the field — plus everything else changing in AI regulation. Every Thursday.