---
title: "AI governance and regulationWavect"
canonical: https://wavect.io/blog/clusters/ai-governance/
language: en
description: "Security, policy, compliance and operating controls for responsible AI adoption."
image: "https://wavect.io/img/general/bak/open_graph_preview.jpg"
---

Cluster

# AI governance and regulation

Security, policy, compliance and operating controls for responsible AI adoption.

## Start with the cornerstone

- [**EU AI Act Cost for a 5-Person Startup**Line-item EUR 30 to 80k breakdown. Legal review, risk classification, technical documentation, conformity assessment, data governance, post-market monitoring.](/blog/eu-ai-act-compliance-cost-startup/)

## Latest in this collection

### [Cyber Resilience Act Reporting: 24-Hour Playbook](/blog/cyber-resilience-act-reporting-playbook-2026/)

- **Details:** Business & Regulation · 24 Aug 2026

Build the evidence pipeline, decision rights, and incident workflow needed when CRA reporting starts on 11 September 2026.

### [EU Product Liability for Software: Evidence Checklist](/blog/eu-product-liability-software-evidence-2026/)

- **Details:** Business & Regulation · 24 Aug 2026

Build the release, test, incident, and update evidence chain needed for software placed on the EU market after 9 December 2026.

### [AI Bill of Materials: CycloneDX vs SPDX](/blog/ai-bill-of-materials-cyclonedx-spdx-2026/)

- **Details:** Business & Regulation · 24 Aug 2026

Choose an AIBOM format, define model and dataset provenance, and generate signed inventory from the release pipeline.

### [LLM Pseudonymization Gateways: Does the Prompt Leave GDPR Scope?](/blog/llm-pseudonymization-gateway-gdpr-2026/)

- **Details:** Business & Regulation · 18 Aug 2026

Platforms in this category promise that pseudonymizing a prompt makes a hosted model safe to use. The 2025 CJEU ruling and the EDPB guidance say something narrower. Here is the evidence a buyer actually has to collect.

### [Semantica Review 2026: Can It Explain Every AI Agent Decision?](/blog/semantica-ai-agent-decision-provenance/)

- **Details:** Business & Regulation · 14 Aug 2026

A buyer-focused review of Semantica for decision provenance, policy gates and regulated AI audit trails, including security limits and a two-week pilot scorecard.

### [AI Agent Contract Signing: eIDAS QES Integration Guide](/blog/ai-agent-eidas-signature-integration/)

- **Details:** Business & Regulation · 13 Aug 2026

A developer and buyer guide to binding AI-generated contracts to human approval, remote QES, ID Austria or EUDI Wallet flows, validation and audit evidence.

## Complete article directory

1. [Cyber Resilience Act Reporting: 24-Hour Playbook](/blog/cyber-resilience-act-reporting-playbook-2026/) 24 Aug 2026
2. [EU Product Liability for Software: Evidence Checklist](/blog/eu-product-liability-software-evidence-2026/) 24 Aug 2026
3. [AI Bill of Materials: CycloneDX vs SPDX](/blog/ai-bill-of-materials-cyclonedx-spdx-2026/) 24 Aug 2026
4. [LLM Pseudonymization Gateways: Does the Prompt Leave GDPR Scope?](/blog/llm-pseudonymization-gateway-gdpr-2026/) 18 Aug 2026
5. [Semantica Review 2026: Can It Explain Every AI Agent Decision?](/blog/semantica-ai-agent-decision-provenance/) 14 Aug 2026
6. [AI Agent Contract Signing: eIDAS QES Integration Guide](/blog/ai-agent-eidas-signature-integration/) 13 Aug 2026
7. [Terafab: Who Controls the AI Stack From Silicon to Orbit?](/blog/terafab-vertical-integration-ai-stack/) 7 Aug 2026
8. [Can AI Create Viruses? What Stanford Actually Proved](/blog/ai-designed-viruses-stanford-biosecurity/) 7 Aug 2026
9. [Stripe Billing and E-Invoicing 2027](/blog/stripe-billing-e-invoicing-2027/) 4 Aug 2026
10. [EU AI Act Article 50 Checklist for SaaS and AI Agents](/blog/eu-ai-act-article-50-checklist/) 23 Jul 2026
11. [AI Agent SLA Template: Accuracy, Latency, Human Handoff and Auditability](/blog/ai-agent-sla-template/) 19 Jul 2026
12. [EU AI Vendor Security Questionnaire: 45 Questions Before You Sign](/blog/ai-vendor-security-questionnaire-eu/) 17 Jul 2026
13. [DACH AI Adoption Benchmark 2026: What SMEs Put Into Production](/blog/dach-ai-adoption-benchmark-2026/) 17 Jul 2026
14. [EU Data Residency for AI APIs in 2026: Provider Guide](/blog/eu-data-residency-ai-apps-2026/) 21 Jun 2026
15. [The One-Page AI Policy for a DACH Company](/blog/ai-policy-one-page-dach/) 15 Jun 2026
16. [EU AI Act Cost for a 5-Person Startup](/blog/eu-ai-act-compliance-cost-startup/) 26 May 2026
17. [MiCA + FMA Reality Austria 2026](/blog/mica-fma-crypto-licensing-austria-2026/) 26 May 2026
18. [GDPR + EU AI Act for DACH SaaS](/blog/gdpr-ai-act-stacking-dach-saas/) 26 May 2026

## Structured Data

```json
{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@id": "https://wavect.io/#organization",
      "@type": [
        "Organization",
        "ProfessionalService",
        "LocalBusiness"
      ],
      "employee": [
        {
          "@id": "https://wavect.io/team/kevin-riedl/#person",
          "@type": "Person",
          "jobTitle": "Managing Director",
          "name": "Kevin Riedl",
          "url": "https://wavect.io/team/kevin-riedl/",
          "worksFor": {
            "@id": "https://wavect.io/#organization",
            "@type": [
              "Organization",
              "ProfessionalService",
              "LocalBusiness"
            ]
          }
        },
        {
          "@id": "https://wavect.io/team/christof-jori/#person",
          "@type": "Person",
          "jobTitle": "Managing Director",
          "name": "Christof Jori",
          "url": "https://wavect.io/team/christof-jori/",
          "worksFor": {
            "@id": "https://wavect.io/#organization",
            "@type": [
              "Organization",
              "ProfessionalService",
              "LocalBusiness"
            ]
          }
        }
      ],
      "founder": [
        {
          "@id": "https://wavect.io/team/kevin-riedl/#person",
          "@type": "Person",
          "jobTitle": "Managing Director",
          "name": "Kevin Riedl",
          "url": "https://wavect.io/team/kevin-riedl/",
          "worksFor": {
            "@id": "https://wavect.io/#organization",
            "@type": [
              "Organization",
              "ProfessionalService",
              "LocalBusiness"
            ]
          }
        },
        {
          "@id": "https://wavect.io/team/christof-jori/#person",
          "@type": "Person",
          "jobTitle": "Managing Director",
          "name": "Christof Jori",
          "url": "https://wavect.io/team/christof-jori/",
          "worksFor": {
            "@id": "https://wavect.io/#organization",
            "@type": [
              "Organization",
              "ProfessionalService",
              "LocalBusiness"
            ]
          }
        }
      ],
      "legalRepresentative": [
        {
          "@id": "https://wavect.io/team/kevin-riedl/#person",
          "@type": "Person",
          "jobTitle": "Managing Director",
          "name": "Kevin Riedl",
          "url": "https://wavect.io/team/kevin-riedl/",
          "worksFor": {
            "@id": "https://wavect.io/#organization",
            "@type": [
              "Organization",
              "ProfessionalService",
              "LocalBusiness"
            ]
          }
        },
        {
          "@id": "https://wavect.io/team/christof-jori/#person",
          "@type": "Person",
          "jobTitle": "Managing Director",
          "name": "Christof Jori",
          "url": "https://wavect.io/team/christof-jori/",
          "worksFor": {
            "@id": "https://wavect.io/#organization",
            "@type": [
              "Organization",
              "ProfessionalService",
              "LocalBusiness"
            ]
          }
        }
      ],
      "name": "Wavect GmbH",
      "subjectOf": {
        "@id": "https://wavect.io/verified-claims.json#dataset",
        "@type": "Dataset",
        "creator": {
          "@id": "https://wavect.io/#organization",
          "@type": [
            "Organization",
            "ProfessionalService",
            "LocalBusiness"
          ]
        },
        "description": "A machine-readable registry of quantitative and qualitative claims published by Wavect, with review dates, localized page appearances and public third-party citations where available.",
        "inLanguage": "en",
        "isAccessibleForFree": true,
        "license": "https://creativecommons.org/licenses/by/4.0/",
        "name": "Wavect verified publication claims",
        "url": "https://wavect.io/verified-claims.json"
      },
      "url": "https://wavect.io/"
    },
    {
      "@id": "https://wavect.io/team/kevin-riedl/#person",
      "@type": "Person",
      "jobTitle": "Managing Director",
      "name": "Kevin Riedl",
      "sameAs": [
        "https://www.wikidata.org/wiki/Q139796365",
        "https://www.linkedin.com/in/wsdt",
        "https://github.com/wsdt"
      ],
      "url": "https://wavect.io/team/kevin-riedl/",
      "worksFor": {
        "@id": "https://wavect.io/#organization",
        "@type": [
          "Organization",
          "ProfessionalService",
          "LocalBusiness"
        ]
      }
    },
    {
      "@id": "https://wavect.io/team/christof-jori/#person",
      "@type": "Person",
      "jobTitle": "Managing Director",
      "name": "Christof Jori",
      "sameAs": [
        "https://www.wikidata.org/wiki/Q139796367",
        "https://www.linkedin.com/in/jocr77/",
        "https://github.com/jo-chris"
      ],
      "url": "https://wavect.io/team/christof-jori/",
      "worksFor": {
        "@id": "https://wavect.io/#organization",
        "@type": [
          "Organization",
          "ProfessionalService",
          "LocalBusiness"
        ]
      }
    },
    {
      "@id": "https://wavect.io/#website",
      "@type": "WebSite",
      "inLanguage": [
        "en",
        "de",
        "es",
        "zh"
      ],
      "name": "Wavect",
      "potentialAction": {
        "@type": "SearchAction",
        "query-input": "required name=search_term_string",
        "target": {
          "@type": "EntryPoint",
          "urlTemplate": "https://wavect.io/search/?q={search_term_string}"
        }
      },
      "publisher": {
        "@id": "https://wavect.io/#organization",
        "@type": [
          "Organization",
          "ProfessionalService",
          "LocalBusiness"
        ]
      },
      "url": "https://wavect.io/"
    },
    {
      "@id": "https://wavect.io/blog/clusters/ai-governance/#webpage",
      "@type": "WebPage",
      "dateModified": "2026-08-05",
      "inLanguage": "en",
      "isPartOf": {
        "@id": "https://wavect.io/#website",
        "@type": "WebSite"
      },
      "lastReviewed": "2026-08-05",
      "url": "https://wavect.io/blog/clusters/ai-governance/"
    }
  ]
}
```

```json
{
  "@context": "https://schema.org",
  "@type": "BreadcrumbList",
  "itemListElement": [
    {
      "@type": "ListItem",
      "item": "https://wavect.io/",
      "name": "Home",
      "position": 1
    },
    {
      "@type": "ListItem",
      "item": "https://wavect.io/blog/overview/",
      "name": "Blog",
      "position": 2
    },
    {
      "@type": "ListItem",
      "item": "https://wavect.io/blog/topics/business-regulation/",
      "name": "Business and regulation",
      "position": 3
    },
    {
      "@type": "ListItem",
      "item": "https://wavect.io/blog/clusters/ai-governance/",
      "name": "AI governance and regulation",
      "position": 4
    }
  ]
}
```

```json
{
  "@context": "https://schema.org",
  "@type": "CollectionPage",
  "about": "Business and regulation",
  "description": "Security, policy, compliance and operating controls for responsible AI adoption.",
  "mainEntity": {
    "@type": "ItemList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "name": "Cyber Resilience Act Reporting: 24-Hour Playbook",
        "position": 1,
        "url": "https://wavect.io/blog/cyber-resilience-act-reporting-playbook-2026/"
      },
      {
        "@type": "ListItem",
        "name": "EU Product Liability for Software: Evidence Checklist",
        "position": 2,
        "url": "https://wavect.io/blog/eu-product-liability-software-evidence-2026/"
      },
      {
        "@type": "ListItem",
        "name": "AI Bill of Materials: CycloneDX vs SPDX",
        "position": 3,
        "url": "https://wavect.io/blog/ai-bill-of-materials-cyclonedx-spdx-2026/"
      },
      {
        "@type": "ListItem",
        "name": "LLM Pseudonymization Gateways: Does the Prompt Leave GDPR Scope?",
        "position": 4,
        "url": "https://wavect.io/blog/llm-pseudonymization-gateway-gdpr-2026/"
      },
      {
        "@type": "ListItem",
        "name": "Semantica Review 2026: Can It Explain Every AI Agent Decision?",
        "position": 5,
        "url": "https://wavect.io/blog/semantica-ai-agent-decision-provenance/"
      },
      {
        "@type": "ListItem",
        "name": "AI Agent Contract Signing: eIDAS QES Integration Guide",
        "position": 6,
        "url": "https://wavect.io/blog/ai-agent-eidas-signature-integration/"
      },
      {
        "@type": "ListItem",
        "name": "Terafab: Who Controls the AI Stack From Silicon to Orbit?",
        "position": 7,
        "url": "https://wavect.io/blog/terafab-vertical-integration-ai-stack/"
      },
      {
        "@type": "ListItem",
        "name": "Can AI Create Viruses? What Stanford Actually Proved",
        "position": 8,
        "url": "https://wavect.io/blog/ai-designed-viruses-stanford-biosecurity/"
      },
      {
        "@type": "ListItem",
        "name": "Stripe Billing and E-Invoicing 2027",
        "position": 9,
        "url": "https://wavect.io/blog/stripe-billing-e-invoicing-2027/"
      },
      {
        "@type": "ListItem",
        "name": "EU AI Act Article 50 Checklist for SaaS and AI Agents",
        "position": 10,
        "url": "https://wavect.io/blog/eu-ai-act-article-50-checklist/"
      },
      {
        "@type": "ListItem",
        "name": "AI Agent SLA Template: Accuracy, Latency, Human Handoff and Auditability",
        "position": 11,
        "url": "https://wavect.io/blog/ai-agent-sla-template/"
      },
      {
        "@type": "ListItem",
        "name": "EU AI Vendor Security Questionnaire: 45 Questions Before You Sign",
        "position": 12,
        "url": "https://wavect.io/blog/ai-vendor-security-questionnaire-eu/"
      },
      {
        "@type": "ListItem",
        "name": "DACH AI Adoption Benchmark 2026: What SMEs Put Into Production",
        "position": 13,
        "url": "https://wavect.io/blog/dach-ai-adoption-benchmark-2026/"
      },
      {
        "@type": "ListItem",
        "name": "EU Data Residency for AI APIs in 2026: Provider Guide",
        "position": 14,
        "url": "https://wavect.io/blog/eu-data-residency-ai-apps-2026/"
      },
      {
        "@type": "ListItem",
        "name": "The One-Page AI Policy for a DACH Company",
        "position": 15,
        "url": "https://wavect.io/blog/ai-policy-one-page-dach/"
      },
      {
        "@type": "ListItem",
        "name": "EU AI Act Cost for a 5-Person Startup",
        "position": 16,
        "url": "https://wavect.io/blog/eu-ai-act-compliance-cost-startup/"
      },
      {
        "@type": "ListItem",
        "name": "MiCA + FMA Reality Austria 2026",
        "position": 17,
        "url": "https://wavect.io/blog/mica-fma-crypto-licensing-austria-2026/"
      },
      {
        "@type": "ListItem",
        "name": "GDPR + EU AI Act for DACH SaaS",
        "position": 18,
        "url": "https://wavect.io/blog/gdpr-ai-act-stacking-dach-saas/"
      }
    ],
    "numberOfItems": 18
  },
  "name": "AI governance and regulation",
  "url": "https://wavect.io/blog/clusters/ai-governance/"
}
```