Collection

AI governance and regulation

Security, policy, compliance and operating controls for responsible AI adoption.

Blog posts
21
Topic
Business and regulation

Start here

Latest in this collection

Layered harness frames around a fixed model, illustrating recursive improvement rather than model retraining Business & Regulation

Google Harness²: Setup, Benchmarks and the Real Cost

Better agent results without retraining the model? Read what Google Harness² changes, what its benchmarks prove, and why a safe pilot needs a cost and acceptance boundary.

Kevin Riedl
Read
Stacked computing layers illustrating a model distributed across devices Business & Regulation

Anthropic's self-replicating AI warning: the local AI takeaway

A security warning with an unexpected local-AI lesson. Separate the three experiments, check the speed arithmetic and make ownership testable.

Kevin Riedl
Read
CRA incident timeline with 24-hour, 72-hour, and final-report checkpoints Business & Regulation

Cyber Resilience Act Reporting: The 24/72-Hour Operational Playbook

Operational CRA reporting: 24/72-hour deadlines, distinct final reports for exploited vulnerabilities and severe incidents, ownership and submission evidence.

Kevin Riedl
Read
Software evidence chain linking requirements, tests, releases, incidents, and updates Business & Regulation

EU Product Liability for Software: Evidence Checklist

Build the release, test, incident, and update evidence chain needed for software placed on the EU market after 8 December 2026.

Kevin Riedl
Read
AI bill of materials comparing CycloneDX and SPDX for models, datasets, and software Business & Regulation

AI Bill of Materials: CycloneDX vs SPDX

Choose an AIBOM format, define model and dataset provenance, and generate signed inventory from the release pipeline.

Kevin Riedl
Read
A prompt passing through a pseudonymization layer, with the re-identification key staying on the controller side Business & Regulation

LLM Pseudonymization Gateways: Does the Prompt Leave GDPR Scope?

Platforms in this category promise that pseudonymizing a prompt makes a hosted model safe to use. The 2025 CJEU ruling and the EDPB guidance say something narrower. Here is the evidence a buyer actually has to collect.

Kevin Riedl
Read

Complete article directory

  1. Google Harness²: Setup, Benchmarks and the Real Cost
  2. Anthropic's self-replicating AI warning: the local AI takeaway
  3. Cyber Resilience Act Reporting: The 24/72-Hour Operational Playbook
  4. EU Product Liability for Software: Evidence Checklist
  5. AI Bill of Materials: CycloneDX vs SPDX
  6. LLM Pseudonymization Gateways: Does the Prompt Leave GDPR Scope?
  7. Semantica Review 2026: Can It Explain Every AI Agent Decision?
  8. AI Agent Contract Signing: eIDAS QES Integration Guide
  9. Terafab: Who Controls the AI Stack From Silicon to Orbit?
  10. Can AI Create Viruses? What Stanford Actually Proved
  11. PII Redaction Before LLM Prompts: A Practical Pipeline
  12. Stripe Billing and E-Invoicing 2027
  13. EU AI Act Article 50 Checklist for SaaS and AI Agents
  14. AI Agent SLA Template: Accuracy, Latency, Human Handoff and Auditability
  15. EU AI Vendor Security Questionnaire: 45 Questions Before You Sign
  16. DACH AI Adoption Benchmark 2026: What SMEs Put Into Production
  17. EU Data Residency for AI APIs in 2026: Provider Guide
  18. The One-Page AI Policy for a DACH Company
  19. EU AI Act Cost for a Startup: Scope Before Budget
  20. MiCA + FMA Reality Austria 2026
  21. GDPR + EU AI Act for DACH SaaS
Inbox, without the noise

Get the next Business and regulation field note

One concise email when we publish. No tracking pixels, and no inbox filler.