Verification
A checklist for validating AI security and compliance operations.
Written and reviewed by Eric Han · Co-founder & CTO, reopt
October 23, 2026 primary-source review
Compared the Commission's Omnibus announcement and Article 50 FAQ, MCP's July 28 security guidance, and OWASP's September ACS and October red-team manual announcements. Automated access to the full EUR-Lex amendment was blocked, so no new detailed legal exceptions are asserted. Existing Korean commencement guidance is retained; this does not claim a complete review of Korean implementing notices.
Validation covers documentation, links, MDX structure, and source alignment. It does not establish a service's legal classification, certification, or completion of penetration testing.
AI Omnibus entry into force · Article 50 FAQ
Earlier verification records
Use this checklist before treating an AI product as production-ready from a security and compliance perspective.
Governance
| Check | Pass condition |
|---|---|
| System register | All AI systems have owners and risk class |
| Risk register | High risks have mitigation and approval |
| Control catalog | Required controls are mapped to systems |
| Review cadence | Risk is reviewed after changes and incidents |
Controls
| Check | Pass condition |
|---|---|
| Data protection | Sensitive data paths, retention, and logs are governed |
| Prompt injection | Input, retrieval, and tool surfaces are tested |
| Access control | Human, service, and agent permissions are separated |
| Audit evidence | Evidence exists for each critical control |
Operations
| Check | Pass condition |
|---|---|
| Incident runbook | AI-specific incident classes and contacts are documented |
| Board reporting | Residual risk and investment decisions are visible |
| Exceptions | Risk appetite exceptions have owners and expiration dates |