Security & Compliance in the AI Era: A Practical Operator's Map

Compliance frameworks multiplied faster than most security teams could absorb. The temptation is to chase certifications. The discipline is to build one operating model that satisfies all of them by design, and then map the certifications onto it as evidence rather than treating each one as a separate project.

What is actually new

• AI-specific obligations: model documentation, training-data lineage, human-in-the-loop for high-risk decisions. The EU AI Act is the template the rest of the world is borrowing from.
• Cross-border data residency rules tightening across Africa (POPIA, NDPR) and the EU. Expect more, not fewer, regional carve-outs over the next 24 months.
• Breach notification windows shrinking, 72 hours is now the floor, not the ceiling. Some jurisdictions are testing 24-hour windows for critical infrastructure.
• Auditor expectations around continuous evidence. Annual snapshot audits are being replaced by always-on attestation.

What good operators do

• Treat compliance as a product: roadmap, owners, SLAs, the whole apparatus you would apply to a customer-facing feature.
• Automate evidence collection. Manual audits are how teams burn out and how findings slip through.
• Build a single control framework that maps to every regulation you care about. Maintain the framework, not the certifications.
• Run quarterly tabletop exercises against the threats that actually apply to your stack, not the generic ones in the textbook.

The AI-specific layer

If you ship anything model-driven, you now own three new control families: data lineage, model behaviour, and human oversight. Each one needs its own evidence trail, its own owner, and its own incident pathway. The teams that bolt this on as an afterthought will fail their first regulated audit. The teams that build it into the platform will pass and use the result as a sales asset.

Sterdam runs this playbook with members. The framework scales from a 10-person startup to a regulated enterprise without re-architecting, because the primitives, policy as code, evidence as telemetry, oversight as workflow, are the same at every size.