AI Security and Compliance Operations
A practical CISO and CTO framework for operating AI products securely and auditably.
Written and reviewed by Eric Han · Co-founder & CTO, reopt
Recently Updated Chapters
Govern human, service, and agent permissions with least privilege and rotation.
Build evidence pipelines for AI controls before formal audits begin.
Defend AI systems against malicious instructions in user input, retrieved content, and tool output.
Create an AI risk governance loop with ownership, scoring, approval, and review.
Design AI systems with policy boundaries, isolation, logging, and safe tool access.
October 23, 2026 review
Updated high-risk timelines and literacy changes after the AI Omnibus entered into force, while keeping Article 50's active obligations separate. Connected September's OWASP Agent Control Standard and the October 20 GenAI Red Teaming Manual 1.0 to runtime controls and reproducible checks. Legal classification, internal risk scores, and security frameworks remain separate records.
AI Omnibus entry into force · Article 50 FAQ
AI security cannot be solved by a checklist at release time. Teams need to design data boundaries, permission models, controls, and evidence paths from the beginning.
This handbook gives engineering and security leaders a shared operating model for AI risk, controls, audit readiness, incident response, and executive reporting.
Core View
AI compliance is an evidence system. The question is not only whether a control exists, but whether the organization can prove it worked when auditors or executives ask.
Operating Chain
Security Maturity
| Level | State | Operating signal | Promotion condition |
|---|---|---|---|
| L1 Initial | Reactive after incidents | Policies and evidence are scattered | Common risk register |
| L2 Managed | Core controls exist | Access, approval, and logs are standardized | Control effectiveness is measured |
| L3 Quantified | Metrics drive review | Residual risk and coverage are visible | Executive reporting is routine |
| L4 Assured | Evidence and detection are continuous | Teams improve controls quarterly | Risk appetite guides investment |
Contents
Ch1. Risk Governance
Identify, score, own, approve, and review AI risks.
Ch2. Data Protection
Classify data and design retention, encryption, and movement controls.
Ch3. Secure Architecture
Build policy-driven boundaries for AI systems and tools.