Topic hub
Governance as engineering: NIST AI RMF, the EU AI Act, tooling, and governing coding agents inside the enterprise.
Start with the pillar guide
AI governance has become a board-level priority, driven by binding regulation and real risk. The frameworks that define it, the pillars of a program, and how governance translates into architecture, not just policy documents.
Read the guideFrameworks tell you what to do; tools are how you actually do it. The categories of AI governance tooling, a practical look at Microsoft Purview's DSPM for AI, and an honest account of what it does and doesn't cover.
The EU AI Act is the world's first binding AI regulation, and it reaches any organization whose AI touches EU users. The four risk tiers, who it applies to, the recently shifted timeline, the penalties, and what it means for teams building with AI.
As teams adopt Claude and agentic coding tools like Claude Code, governing that usage becomes a real requirement. Anthropic's Compliance API and Enterprise controls make it tractable. What they cover, where the gaps are, and how to implement.
Agents don't just produce outputs, they take actions, which opens an accountability gap traditional governance doesn't close. The novel risks, the control layers that actually work, and why agent governance is an enforcement problem, not a policy one.
The NIST AI RMF is the de facto vocabulary of AI governance. What its four functions actually require, how the Playbook and crosswalks make it usable, and the practitioner realities of implementing it well.
