Resource library

Operational evidence for AI in production.

The rule, the action it governs, and the record a regulator or a customer’s security team can check. These references cover supervision, OVERT, buyer diligence and current regulation, and they don’t mistake a policy document for a record of what ran.

01

Start here

White paper The Proof Gap in Healthcare AI Why intended controls and operational evidence aren’t the same thing.
Open standard OVERT The open record format. Anyone can check a record in their browser, with no Glacis account. Essay The Knowledge of the Insured Insurance was built on an asymmetry of knowledge. AI moves it inside the insured: the organisation may not know what its own software did.

Monthly brief

What changed this month, and what it changes in a review.

One email a month for the person who has to answer the questionnaire: the obligations that moved, the artifact a reviewer will now ask for, and which evidence held up. Colorado’s automated-decision rules take effect on 1 January 2027; the EU AI Act’s high-risk obligations follow. The brief keeps the dates straight.

02

EU AI Act

Current, role-specific guidance with enacted dates distinguished from historical and proposed timelines.

Pillar guide The EU AI Act guide Which systems fall under Annex III and Annex I, the enacted dates for each, and the obligations that follow.

EU member state implementation guides

GermanyBundesnetzagentur oversight, KI-VO implementation, works council requirements. FranceCNIL coordination, sectoral regulators, French AI strategy alignment. SpainAESIA sandbox, early adopter status, regional considerations. ItalyAgID coordination, Garante privacy integration, sectoral enforcement. NetherlandsAutoriteit Persoonsgegevens role, algorithmic impact assessments. BelgiumEU institution proximity, federal structure, BIPT coordination. PolandIT outsourcing hub, cross-border compliance, UODO coordination.

EU AI Act guides by role

CISO guideSecurity requirements, Article 12 logging, cybersecurity integration, incident response. General counsel guideLegal liability, contract requirements, due diligence, regulatory exposure. CCO guideCompliance program design, risk assessment, audit preparation, documentation. CMIO guideClinical AI governance, human oversight, diagnostic AI systems, ambient scribes.
03

UK AI regulation

The UK’s pro-innovation approach to AI governance, sector-specific oversight, and comparison with EU requirements.

UK AI frameworkPro-innovation principles, sector regulators, AI Security Institute, and upcoming legislation. UK vs EU AI ActRegulatory divergence, dual compliance strategies, and cross-border considerations. UK healthcare AIMHRA AI-as-medical-device, CQC oversight, NHS AI & Digital Regulations Service, and clinical AI requirements. UK financial services AIFCA and PRA AI oversight, Consumer Duty, SM&CR accountability, and model risk.
04

US state AI laws

What each state has passed, what is in force now, and the effective dates for the rest.

Overview The US state AI laws tracker Effective dates, a dated change log, and the obligations in force, state by state.
CaliforniaAB 2013 training data transparency, employment AI rules, bot disclosure, and political deepfakes. New YorkNYC Local Law 144 hiring audits, RAISE Act frontier safety, LOADinG Act, and NYDFS guidance. Washington stateFacial recognition regulation, My Health My Data Act, AI Task Force, and pending HB 1168. OregonOCPA profiling opt-out, campaign deepfake disclosure, AG guidance, and 2026 amendments. Colorado AI ActSB 26-189 ADMT transparency (compliance from Jan 1, 2027) California ADMTAutomated decision-making technology
05

Framework crosswalks

Where the AI governance frameworks overlap and where they don’t.

ISO 42001 vs EU AI ActControl mapping, what certification is worth, and where the management standard and the regulation overlap. NIST AI RMF vs EU AI ActUS framework alignment with EU regulation, dual compliance strategies for multinational organizations. EU AI Act vs HIPAAHealthcare AI compliance across jurisdictions, PHI handling with AI systems, dual compliance requirements. NIST AI RMFFunction-by-function guide ISO 42001AI management system FDA AI/ML guidanceMedical device oversight SR 11-7Model risk management
06

Operational evidence and AI security research

Explainers on supervision, independent verification, and the signed records behind both: the OVERT series.

AI agent security: an operating boundary for agentsControls enforced as the agent uses tools and credentials, with a signed record of what was requested and what the control decided. Agentic AI security: runtime coverageWhy agent security is a runtime problem, and what coverage means. AI security controls that leave a recordThe difference between claiming a control fired and having a signed record of it. AI in cyber security: the evidence layerDetection made the SOC faster. A signed record of each covered decision is a different artifact, and one an auditor can check. AI data security: verifying a record with bounded disclosureHow a record can be checked without disclosing the data it protects. Reconstructing what happened after a prompt injection attackWhen an attack lands, the question is what your controls did, and whether you can show it. Fable 5, prompt injection, and verifiable AIWhat the temporary Fable 5 suspension shows about scoped operational evidence. What is AI governance?Beyond policy documents: governance as enforced behavior plus evidence. AI governance tools: beyond the dashboardWhat to demand from governance tooling. AI governance tools buyer’s guideRuntime evidence, evaluation checklist, OVERT. Learn hubRuntime security, prompt security, pen testing guides. AI governance maturity modelFrom policy to record: a maturity path measured in evidence an auditor can check. Documentation versus operational evidenceWhy artifacts of intent and operational records answer different questions. AI governance challenges: the verification gapThe gap between what governance declares and what systems do. What makes AI attestation independent?Independence is a property of who must be trusted to check the claim.
07

High-risk AI use case guides

Compliance guidance for the AI applications the EU AI Act classifies as high-risk.

Healthcare · High-riskAmbient AI scribesClinical documentation AI, HIPAA intersection, consent requirements, Sharp lawsuit implications. Healthcare · High-riskClinical decision supportCDSS compliance, FDA oversight, medical device classification, clinical workflow integration. Healthcare · High-riskAI-assisted diagnosisDiagnostic AI systems, radiology AI, pathology AI, MDR compliance requirements. Financial · High-riskCredit scoring AICreditworthiness assessment, ECOA/FCRA compliance, adverse action requirements, model validation. Financial · High-riskInsurance underwriting AIRisk assessment AI, pricing algorithms, claims processing, actuarial model compliance. HR/Employment · High-riskEmployment AIRecruitment AI, resume screening, performance evaluation, worker monitoring compliance. Security · High-riskBiometric AI systemsFacial recognition, emotion detection, biometric categorization, prohibited uses. Customer service · Limited riskAI chatbotsTransparency requirements, disclosure obligations, when chatbots become high-risk.
08

More resources

Vanta and Drata next to Glacis AI monitoring against AI assurance AI governance platforms compared Answers about AI supervision and evidence JPM 2026 healthcare AI briefing AI workflow assessment What is AI attestation? HIPAA-compliant AI Ambient AI scribe privacy Colorado AI Act guide LLM security Prompt injection defense AI vendor due diligence AI risk assessment AI data governance AI supply chain security Is ISO 42001 certification worth it? AI incident response Generative AI policy AI vendor due diligence checklist Healthcare AI vendor evaluation Healthcare industry overview

From actions to evidence

Wherever the AI already acts, we map the rule you intend, the controls you run, and the record a reviewer would need.

Talk to us