AI Governance (SOC2, EU AI Act)

These are the regimes an enterprise FDE actually meets in the field: SOC 2 for security controls with documented evidence, plus whichever other criteria the report puts in scope, the EU AI Act for risk-tiered obligations on high-risk AI, and data-protection law like GDPR and India's DPDP. In practice they all demand the same primitives: documented controls, human oversight of consequential decisions, audit trails, and disciplined data handling. The FDE move is to design for them from the first deployment, because retrofitting governance into a shipped system is far more expensive than building it in.