Category: Compliance
AI compliance practices, documentation requirements, risk classification, and audit readiness for organisations
Stay ahead of AI change. Get practical updates from Future Prep direct to your inbox.
By subscribing you agree to receive Future Prep news. Unsubscribe any time.
Canada has tabled Bill C-36, a GDPR-style privacy overhaul. For organisations already under European rules it reads as convergence but works as divergence: a second regulator, second thresholds and a second set of rights to map across adequacy, automated decisions and transfers.
CADA defines four assurance levels for cloud and AI sovereignty, up to EU ownership at Level 3 and full supply-chain control at Level 4. The proposal is not law yet, but the levels already work as a scoring frame. Five procurement and due diligence changes to make this quarter.
In one week the US chose voluntary, standards-referenced AI oversight while the EU adopted CADA's graded sovereignty test. A deployer operating across both cannot run on a single mental model. Here is one control map, with two triggers per control, that answers the European and American regimes at once.
The moment you move from buyer to builder, provider obligations, auditability, logging and exit discipline become yours. Here is how a mid-market organisation keeps a proprietary or co-developed AI tool governable, without a large-firm budget, and where the Cyber Resilience Act starts to bite.
Two US rulings show that material run through public AI tools can lose privilege and confidentiality. For EU practitioners, contract terms, deployment environment and acceptable-use rules are the controls that decide whether sensitive work stays protected before the next dispute.
The Commission's draft guidelines of 19 May 2026 set worked examples across all eight Annex III categories. The Annex III classification memo now has an external benchmark. Six fields make the call defensible before the 23 June consultation closes.