The compliance stories enterprise IT leaders actually read.
Volume 343, Issue 3 · 6 articles from 3 issues
Cases from Glovo, Deliveroo, Airbnb, Uber and Meta reveal four signals of when minimal-compliance fixes will fail.
Companies facing new regulation often reach for minimal compliance, but in algorithmic businesses such workarounds leave auditable traces and can spread beyond leaders' control, inviting the redesign they tried to avoid.
A central example is Glovo's app redesign to sidestep the presumption of employment under Spain's Rider Law.
Drawing on cases from Glovo, Deliveroo, Airbnb, Uber and Meta, the authors identify four signals that indicate whether a workaround will hold or whether leaders should prepare for a costly redesign.
Diverging AI rules in the EU, US and China mean data center operators must build verifiable controls and clear contracts.
AI infrastructure is expanding while the EU AI Act, US policies to accelerate buildout, and competing international governance efforts set different expectations for how AI workloads run.
Data Center Frontier argues that operators serving international customers must now provide verifiable controls for security, workload location, data handling and access, with responsibilities spelled out in contracts.
The IEA says global data center electricity demand rose 17% in 2025 and AI-focused facilities 50%, with total use heading toward roughly 950TWh by 2030.
Delivering usable AI capacity increasingly means proving operational readiness and compliance, not just energizing a building.
Hyperproof's CEO argues AI is a useful GRC co-pilot but can't replace systems of record, human accountability or auditable review.
Hyperproof founder and CEO Craig Unger argues AI is both an asset and a risk in governance, risk and compliance, depending on how it is deployed.
AI is useful for automating repetitive evidence work and cross-framework mapping, but it does not provide a version-controlled source of truth, so policy versioning and audit trails still need a formal GRC platform.
AI cannot set risk appetite, buyers increasingly want a named person accountable for AI-assisted decisions, and auditors will want to know how conclusions were reached.
In this vendor-authored post, he advises folding AI governance into existing risk operations.
A risk acceptance record must let the signing executive explain the control gap and consequences, or it won't hold up.
The article describes a VP who cannot explain to an auditor what she accepted 18 months earlier because the record said only residual risk: medium.
It argues that a risk acceptance record is the instrument by which an accountable executive takes personal ownership of a known gap for a defined period, and that GRC owns preparing a record the signer can interrogate.
Citing NIST SP 800-37 Rev. 2, it stresses that acceptance must be an explicit act, not inferred from silence.
The piece walks through commonly miswritten fields, especially the gap statement.
Audits and AI assurance dominated IAPP's Seattle conference as new oversight comes to privacy and AI governance teams.
Reflecting on the IAPP Privacy. Security. Risk. + AI Governance Global 2026 conference in Seattle, the author says audits were the standout theme.
Speakers discussed assessments, assurance and formal audits coming to privacy and AI governance functions, including the emerging discipline of AI assurance and distinctions between assurance roles.
Policymakers are already regulating AI auditors; California passed laws on the profession, and Gov. Gavin Newsom signed an executive order fast-tracking their deadlines.
The author's message is that privacy teams have limited time to get ready for this oversight.
ISACA outlines what the EU's proposed Cybersecurity Act 2 changes for ENISA, certification, skills and ICT supply chains.
The European Commission's proposed Cybersecurity Act 2 is the most significant revision of EU cybersecurity legislation to date, building on a framework that already includes NIS2, DORA, the Cyber Resilience Act and the Cyber Solidarity Act.
CSA2 revises ENISA's mandate, the European Cybersecurity Certification Framework and the European Cybersecurity Skills Framework, and introduces a new framework for ICT supply-chain security.
Parliament's ITRE committee expects a vote in February 2027, while member states aim for a general approach by the end of 2026.
ISACA summarizes four takeaways from its engagement with policymakers on the proposal.
More from Compliance · All IT section newsletters · This week