Loading…
Topic
37 posts about Compliance. Every summary links to the original.
See the idea
APAC is a federation of markets, not a single deployment region. This diagram maps the tradeoff between local autonomy and one shared platform, and the conditions that decide it.
A five-checkpoint walkthrough of BYOC: name the control you need, split control and data planes, build the landing zone, govern data in place, then operate inside your own tenant.
APRA's April 2026 letter flags single-provider concentration as a CPS 230 risk, so AI stacks need a rehearsed substitution path. This flow maps five stages, from workload classification to provider swap.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
New York City couriers who deliver by bike or e-bike must meet requirements covering platform identification, protective equipment, bicycle hardware, and Department of Transportation safety training. The FAQ explains how to submit a New York or New Jersey mailing address in the Uber Driver app, receive an Uber-branded vest and photo ID, request replacements, and troubleshoot shipping or address changes. It lists required equipment including a helmet, front lamp, bell, side reflectors, and working brakes, while noting that replacements are available six months after the first order and brake reimbursements require dated, itemized receipts for eligible purchases on or after April 8, 2026. Training requires a DOT account using the Uber-associated email, a quiz, and certificate sharing through a 10-digit Worker ID or the app.
Massachusetts’s Department of Public Utilities (DPU) is considering proposed changes to transportation-network-company regulations that could affect drivers’ platform access, earnings, and operating costs. The proposal would expand the existing two-part background-check process by requiring seven years of driver-license history, birthplace, full Social Security documentation, Driver Verification System enrollment, and possible consultation with other agencies. It would also give DPU broader suspension authority, restrict hearing and deactivation-appeal rights, impose annual training, block vehicles with any open recall, regulate surge, and require rental vehicles to be electric within one year. Uber Black drivers could face new insurance, registration, and inspection requirements, while TNCs could incur fees that may increase fares. The post provides June 8, 2026 public-hearing details and instructions for submitting testimony.
The AI governance maturity model assesses how deeply governance practices are embedded across an organization’s data, process, and people dimensions, using five stages from Ad Hoc to Optimized. It frames the model as a diagnostic and roadmap for boards and executive sponsors, while a five-dimension matrix separately scores strategy and leadership, policy and ethics, risk management, data governance, and monitoring and observability. The progression moves from discovery and basic ownership through standardized controls, quantified risk, real-time indicators, lineage tracking, and automated, context-aware enforcement. The recommended roadmap starts with a baseline within 30 days, targets Level 3 across the five dimensions within 12 months, runs a 90-day pilot on two or three high-priority systems, then scales effective controls through CI/CD integration and monitoring, with quarterly reviews and annual reassessment.
Resend announces Ben Anderson as its new Ops Generalist, based in London, UK, after he built operating infrastructure at startups, most recently at Treecard. He will develop vendor, finance, and compliance operations as the company scales, bringing experience from a discipline he describes as cross-functional, hands-on, and centered on ownership across the business. Anderson says Resend’s team, product and culture, and transparent values, philosophy, and decision-making process influenced his decision to join. He also discusses running and walking as ways to regain clarity, names 1Password as his favorite tool, advises ambitious operators to seek ownership, prioritise ruthlessly, and learn from experienced operators and mentors, and values teaching complicated topics clearly.
Anthropic, PBC says it has confidentially submitted a draft registration statement on Form S-1 to the U.S. Securities and Exchange Commission for a proposed initial public offering of its common stock. The filing preserves an option to go public after the SEC completes its review, but the offering remains dependent on market conditions and other factors. Anthropic has not set the number of shares or the offering price. Published under Rule 135 of the Securities Act of 1933, the announcement states that it is not an offer to sell securities or a solicitation to buy them; any offers, solicitations, or sales would occur only under the Act’s registration requirements.
Uber’s Notice of Rights describes protections and information available to app-based workers using its platform for delivery work in Seattle, Washington, under Seattle Bill CB 120294 and Seattle Municipal Code Chapter 8.37. It lists guaranteed minimums of $0.47 per engaged minute, $0.80 per engaged mile, and $5.34 per offer, along with required information before accepting an offer. Workers may decide when to be available and whether to accept, reject, or cancel delivery offers, and are protected from retaliation for exercising covered rights. The notice also covers tip and fraudulent-use policies, cancellation reasons, complaint or civil-action rights, and access for up to three years to information required under Sections 8.37.070(B) and (C); Uber directs workers to Customer Support for those records.
Responsible AI governance is presented as an operational framework for leaders overseeing systems that can produce biased outputs, expose sensitive data, and create regulatory, financial, or reputational harm. It draws on the NIST AI RMF and OECD AI principles, maps to EU AI Act requirements, and uses human dignity, fairness, privacy, accountability, transparency, and security as governance values. The program starts with a living inventory recording purpose, ownership, training-data sources, affected populations, review dates, model lineage, and third-party status, followed by risk classification and assessments based on potential impact. It calls for lifecycle controls including bias mitigation, security testing, human review, drift monitoring, audits, incident exercises, and confidential concern reporting. The roadmap recommends piloting governance on a highest-risk product line, scaling controls across business units, and reviewing the framework annually or after major incidents, regulatory updates, or portfolio changes.
Eligible Uber drivers in New York City may receive minimum earnings and several protections established through an agreement involving Uber, the New York Attorney General, and New York City Taxi and Limousine Commission (TLC) rules. For trips beginning in the city, the TLC minimum-pay formula considers time, distance, and driver utilization, while incentives and guarantees count toward earnings but tips, customer-charged fees, and offline promotions do not. As of March 1, 2026, the listed rates are $1.283/mile and $0.681/mile, with different rates possible for wheelchair accessible vehicle (WAV) trips and out-of-city portions. Eligible drivers may also access Black Car Fund benefits, possible unemployment insurance, and paid sick leave, which accrues at one hour per 30 hours worked up to 56 hours yearly and can be redeemed for $18.58 per hour as of that date.
AI systems introduce probabilistic behavior, model drift, adversarial manipulation, bias, and auditability challenges that traditional IT risk practices may not address. The framework described combines NIST AI RMF, EU AI Act, and ISO/IEC 23894:2023, using Govern, Map, Measure, and Manage as its operational structure while recognizing regulatory and societal context. It recommends cross-functional governance, clear risk ownership, an AI-BOM covering systems, data flows, dependencies, and accountability, plus continuous measurement of fairness, explainability, data quality, security vulnerabilities, and harm likelihood and severity. Across the AI lifecycle, the text identifies risks including data poisoning, model drift, malicious library injection, prompt injection, hallucinations, and platform vulnerabilities, and points to the AI RMF Playbook for checklists, timelines, and governance artifacts.
Intercom describes how it uses an AI PR review Agent to approve some pull requests amid a workflow where more than 93% are Agent-driven and engineers deploy hundreds of times daily. The system decomposes review into specialist sub-Agents that assess problem descriptions, intent alignment, safety, logic, best practices, and execution paths, while applying Intercom-specific guidance and enforcing smaller changes. In a pilot of more than 100 PRs, AI-approved changes had zero reverts and approval time improved 6–16 times at the 75th percentile; in four rollout weeks, 497 PRs went fully autonomous. Reported revert rates were lower for AI-authored than human-authored code in both backend and frontend comparisons, though the source says zero reverts will not necessarily persist. The process remains auditable, allows human review requests, and keeps the shipping engineer accountable for production behavior and rollback.
This guide presents a framework for evaluating data governance platforms for enterprise deployment, distinguishing governance—the policies, roles, and controls for data use—from data management, the operational execution of those policies. It recommends assessing metadata-centered capabilities including continuous data profiling, catalog search and enrichment, end-to-end lineage, RBAC and ABAC, sensitive-data detection, masking, audit trails, compliance reporting, and data-subject request workflows. Vendor assessment should also cover pre-built connectors, REST APIs and SDKs, near-real-time metadata synchronization, schema-drift handling, cross-cloud federation, usability, support, implementation timelines, and three-to-five-year total cost of ownership. The proposed decision process selects three leading candidates, pilots them with representative structured and unstructured datasets, defines quality, lineage, adoption, and exit metrics, and uses executive review before procurement; governance is framed as an ongoing program that expands with AI workloads and regulatory change.
Intercom announces that it has achieved AIUC-1 certification, describing it as the first standard designed specifically for AI Agents. The certification complements broader frameworks such as ISO 42001 and addresses enterprise concerns spanning security, customer safety, system reliability, data and privacy, society, and accountability. Organizations seeking AIUC-1 undergo independent third-party audits and quarterly adversarial testing across more than a thousand enterprise risk scenarios, while the standard itself evolves quarterly through the AIUC-1 Consortium. Intercom says the certification extends its governance approach to Fin, its AI Agent, providing independent validation that its AI systems are safe, resilient, regularly tested, safeguarded, and enterprise-ready; it also identifies Intercom as a founding technical contributor to the standard.
Anthropic is updating its Usage Policy to reflect product changes, user feedback, regulatory developments, evolving AI risks, and enforcement priorities, with changes taking effect September 15, 2025. The update adds explicit prohibitions on malicious computer, network, and infrastructure compromise while continuing to permit vulnerability discovery with system-owner consent, and provides supplementary guidance for agentic use. It narrows political restrictions from broad bans on lobbying and campaign content to prohibitions on deceptive or disruptive democratic activity and voter or campaign targeting. Law-enforcement wording is clarified without changing the permitted scope, while high-risk requirements are specified for consumer-facing legal, financial, and employment uses, including human oversight and AI disclosure. Anthropic describes the policy as a living document and says it will continue evaluation with policymakers, experts, and civil society.
Anthropic is updating its Terms of Service to address access by companies from regions where its products are not permitted, including entities operating through foreign subsidiaries. The company says ownership or control from jurisdictions such as China can create legal obligations to share data, cooperate with intelligence services, or support military and intelligence objectives. Under the change, companies or organizations more than 50% owned directly or indirectly by companies headquartered in unsupported regions are prohibited from using the services, regardless of where they operate. Anthropic frames the update as aligning its restrictions with real-world national-security risks and reiterates support for export controls, US energy projects, and rigorous evaluation of AI models for capabilities relevant to national security.
Global applications can move customer data across borders, making data residency a compliance concern for organizations serving multinational users. The post defines data residency as legal requirements governing where data may be stored and processed, then distinguishes it from data sovereignty’s jurisdictional reach and data localization’s requirement that storage and processing remain within a jurisdiction. It notes that GDPR and CCPA focus on compliant handling and individual rights rather than necessarily mandating storage locations, while China’s Personal Information Protection Law requires certain Chinese citizens’ PII to be stored within China. The proposed approach uses cloud regions to align storage with local requirements, citing Heroku Enterprise Private Dynos across ten regions and Heroku Shield Private Spaces’ PCI, HIPAA, ISO, and SOC certifications; the post concludes that these features can make compliance more achievable while improving control and potentially application performance.
Fly.io’s SOC2 certification prompts an explanation of what the audit measures, when companies should pursue it, and what security value customers should assign to it. The post characterizes SOC2 as an accounting-style audit of documented company security processes, centered on an auditor-customized Document Request List (DRL) and screenshots, rather than adversarial product testing. It distinguishes Type I’s point-in-time snapshot from Type II’s multi-month confirmation and recommends doing the engineering work early, while delaying certification until customer demand justifies it. Fly.io prepared for more than a year and describes controls including Google SSO, certificate-based SSH access through Teleport, VPN gating, GitHub SSO, and session audit logs. The resulting certification improved processes but remains a weak positive security signal: SOC2 can miss much of a company’s technical security model, so penetration tests and clear security reporting still matter.
Intercom announces that it has completed a HIPAA attestation examination covering how it stores and processes health-related data, including protected health information (PHI) and electronic protected health information (ePHI). The examination was performed by an independent Certified Public Accounting firm, which reviewed HIPAA policies, procedures, and controls against the HIPAA Security Rule and HITECH Breach Notification Rule requirements. Intercom says the result allows it to enter Business Associate Agreements with applicable healthcare customers and make the attestation report available for review. Reported customer metrics include a 90% median CSAT score, 36% automatic resolution of common healthcare questions, and more than 500k healthcare conversations powered daily. Intercom also says it will perform the examination annually, alongside its stated ISO:27001 certification, SOC 2 Type 2 compliance, GDPR and CCPA compliance.
The best engineering reads, once a week.
